@budibase/backend-core
Budibase backend core libraries used in server and worker
15
Versions
GPL-3.0
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
melbudibasepclmntjoranamochristos-budibase
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| license | copyleft-license:GPL-3.0 | AI (license): GPL-3.0 is the declared license; stable for this package. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Active Budibase monorepo sub-package; publish gaps are expected and not indicative of takeover. | ai | |
| dependencies | unvetted-dep:pouchdb-find | AI (dependencies): Official PouchDB query plugin; stable and expected alongside pouchdb dependency. | ai | |
| dependencies | unvetted-dep:@budibase/nano | AI (dependencies): Budibase-maintained CouchDB client fork; expected in Budibase backend-core. | ai | |
| dependencies | unvetted-dep:correlation-id | AI (dependencies): Standard request correlation library; benign for backend logging. | ai | |
| dependencies | unvetted-dep:koa-pino-logger | AI (dependencies): Standard Koa logging middleware; consistent with koa usage in this package. | ai | |
| dependencies | unvetted-dep:aws-cloudfront-sign | AI (dependencies): CloudFront URL signing utility; expected in AWS-integrated backend. | ai | |
| dependencies | unvetted-dep:bull | AI (dependencies): Legitimate Redis-backed job queue; consistent with backend-core usage across many versions. | ai | |
| dependencies | unvetted-dep:sanitize-s3-objectkey | AI (dependencies): Small S3 key sanitization utility; consistent with S3 usage in this package. | ai | |
| dependencies | unvetted-dep:passport-oauth2-refresh | AI (dependencies): Standard OAuth2 token refresh for Passport.js; expected for auth. | ai | |
| dependencies | unvetted-dep:@govtechsg/passport-openidconnect | AI (dependencies): OpenID Connect Passport strategy; expected for SSO/OIDC support. | ai | |
| dependencies | unvetted-dep:@budibase/pouchdb-replication-stream | AI (dependencies): Budibase-maintained PouchDB replication fork; expected in Budibase backend-core. | ai | |
| provenance | no-provenance | AI (provenance): Established Budibase monorepo package; lack of provenance is consistent across all its versions. | ai | |
| dependencies | unvetted-dep:passport-google-oauth | AI (dependencies): Official Passport.js Google OAuth strategy; expected for auth features. | ai | |
| dependencies | unvetted-dep:redlock | AI (dependencies): Standard distributed lock library for Redis; expected in backend-core. | ai |