@angular-devkit/build-webpack
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:css-loader | AI (phantom-deps): css-loader is a webpack loader referenced in build config files, not directly imported. Standard pattern for Angular build tooling. | ai | |
| phantom-deps | phantom-dep:exports-loader | AI (phantom-deps): exports-loader is a webpack loader referenced in build config files, not directly imported. Standard pattern for Angular build tooling. | ai | |
| phantom-deps | phantom-dep:postcss-loader | AI (phantom-deps): Optional webpack loader for PostCSS; standard pattern for Angular build tooling. | ai | |
| phantom-deps | phantom-dep:sass-loader | AI (phantom-deps): Optional webpack loader for CSS preprocessing; standard pattern for Angular build tooling. | ai | |
| phantom-deps | phantom-dep:style-loader | AI (phantom-deps): Optional webpack loader; standard pattern for Angular build tooling. | ai | |
| phantom-deps | phantom-dep:stylus-loader | AI (phantom-deps): Optional webpack loader for CSS preprocessing; standard pattern for Angular build tooling. | ai | |
| phantom-deps | phantom-dep:less | AI (phantom-deps): Optional CSS preprocessor dependency; build tools list these for conditional use based on project config, not direct import. | ai | |
| phantom-deps | phantom-dep:stylus | AI (phantom-deps): Optional CSS preprocessor dependency; standard pattern for Angular build tooling. | ai | |
| phantom-deps | phantom-dep:node-sass | AI (phantom-deps): Optional CSS preprocessor dependency; standard pattern for Angular build tooling. | ai | |
| phantom-deps | phantom-dep:lodash | AI (phantom-deps): Utility library referenced in config/build files; phantom detection is a false positive for this build tool package. | ai | |
| phantom-deps | phantom-dep:request | AI (phantom-deps): HTTP utility used conditionally in build tooling; phantom detection is a false positive here. | ai | |
| phantom-deps | phantom-dep:less-loader | AI (phantom-deps): Optional webpack loader for CSS preprocessing; standard pattern for Angular build tooling. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): Build tooling legitimately uses child_process to fork webpack/build processes. This is expected behavior for @angular-devkit/build-webpack across all versions. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Used as a standard ESM dynamic import() workaround in CJS context within Angular CLI build tooling. Input is a developer-controlled config path, not external user input. Stable pattern across Angular CLI versions. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require() loads developer-specified webpack config files — expected behavior for a build tool. No security risk in this context. | ai |
Versions (showing 51 of 525)
| Version | Deps | Published |
|---|---|---|
| 0.2200.8 | 2 / 0 | |
| 0.2200.7 | 2 / 0 | |
| 0.2200.6 | 2 / 0 | |
| 0.2200.5 | 2 / 0 | |
| 0.2200.4 | 2 / 0 | |
| 0.2200.3 | 2 / 0 | |
| 0.2200.2 | 2 / 0 | |
| 0.2200.1 | 2 / 0 | |
| 0.2200.0 | 2 / 0 | |
| 0.2102.19 | 2 / 0 | |
| 0.2102.18 | 2 / 0 | |
| 0.2102.17 | 2 / 0 | |
| 0.2102.16 | 2 / 0 | |
| 0.2102.15 | 2 / 0 | |
| 0.2102.14 | 2 / 0 | |
| 0.2102.13 | 2 / 0 | |
| 0.2102.12 | 2 / 0 | |
| 0.2102.11 | 2 / 0 | |
| 0.2102.10 | 2 / 0 | |
| 0.2102.9 | 2 / 0 | |
| 0.2102.8 | 2 / 0 | |
| 0.2102.7 | 2 / 0 | |
| 0.2102.6 | 2 / 0 | |
| 0.2102.5 | 2 / 0 | |
| 0.2102.4 | 2 / 0 | |
| 0.2102.3 | 2 / 0 | |
| 0.2102.2 | 2 / 0 | |
| 0.2102.1 | 2 / 0 | |
| 0.2102.0 | 2 / 0 | |
| 0.2101.5 | 2 / 0 | |
| 0.2101.4 | 2 / 0 | |
| 0.2101.3 | 2 / 0 | |
| 0.2101.2 | 2 / 0 | |
| 0.2101.1 | 2 / 0 | |
| 0.2101.0 | 2 / 0 | |
| 0.2100.6 | 2 / 0 | |
| 0.2100.5 | 2 / 0 | |
| 0.2100.4 | 2 / 0 | |
| 0.2100.3 | 2 / 0 | |
| 0.2100.2 | 2 / 0 | |
| 0.2100.1 | 2 / 0 | |
| 0.2100.0 | 2 / 0 | |
| 0.2003.32 | 2 / 0 | |
| 0.2003.31 | 2 / 0 | |
| 0.2003.30 | 2 / 0 | |
| 0.2003.29 | 2 / 0 | |
| 0.2003.28 | 2 / 0 | |
| 0.2003.27 | 2 / 0 | |
| 0.2003.26 | 2 / 0 | |
| 0.2003.25 | 2 / 0 | |
| 0.2003.24 | 2 / 0 |
v0.2200.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2200.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2200.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2200.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2102.19
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2102.18
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2003.32
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2003.31
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.