@datagrok-libraries/compute-utils
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): Deps are well-known utility packages, no exec/fetch behavior. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Org-internal maintainer addition, publisher track record is clean. | ai | |
| source-diff | obfuscated-file:composition-pipeline/src/CompositionPipeline.js | AI (source-diff): TSC-compiled output with sourcemap, not obfuscation. | ai | |
| source-diff | large-new-source-files | AI (source-diff): New feature module consistent with package scope. | ai | |
| source-diff | obfuscated-file:composition-pipeline/src/runtime/PipelineRuntime.js | AI (source-diff): TSC-compiled output with sourcemap, not obfuscation. | ai | |
| dependencies | unvetted-dep:@datagrok/diff-grok | AI (dependencies): First-party datagrok namespace dep; consistent with this package's ecosystem and publisher. | ai | |
| provenance | no-provenance | AI (provenance): Consistent across all 172 versions of this package; publisher pattern does not use Sigstore attestation. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Used in formula/math expression evaluator (compileFormula); expected pattern for this library. | ai | |
| phantom-deps | phantom-dep:@types/lodash.clonedeepwith | AI (phantom-deps): Type-only package; not directly imported by convention. | ai | |
| phantom-deps | phantom-dep:lodash.clonedeepwith | AI (phantom-deps): Referenced in config; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:lodash.isequal | AI (phantom-deps): Referenced in config; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@types/uuid | AI (phantom-deps): Type-only package; not directly imported by convention. | ai |
Versions (showing 39 of 39)
| Version | Deps | Published |
|---|---|---|
| 1.46.8 | 21 / 11 | |
| 1.46.7 | 21 / 11 | |
| 1.46.6 | 21 / 11 | |
| 1.46.5 | 21 / 11 | |
| 1.46.4 | 21 / 11 | |
| 1.46.3 | 21 / 11 | |
| 1.46.2 | 21 / 11 | |
| 1.46.1 | 21 / 11 | |
| 1.46.0 | 21 / 11 | |
| 1.45.3 | 18 / 10 | |
| 1.45.2 | 18 / 10 | |
| 1.45.1 | 18 / 10 | |
| 1.45.0 | 18 / 10 | |
| 1.44.13 | 18 / 9 | |
| 1.44.12 | 18 / 9 | |
| 1.44.11 | 18 / 10 | |
| 1.44.10 | 18 / 10 | |
| 1.44.9 | 18 / 10 | |
| 1.44.8 | 18 / 10 | |
| 1.44.7 | 18 / 10 | |
| 1.44.6 | 18 / 10 | |
| 1.44.5 | 18 / 10 | |
| 1.44.3 | 17 / 10 | |
| 1.44.2 | 17 / 10 | |
| 1.44.1 | 17 / 10 | |
| 1.43.11 | 17 / 11 | |
| 1.43.10 | 17 / 11 | |
| 1.43.9 | 17 / 11 | |
| 1.43.8 | 16 / 10 | |
| 1.43.7 | 16 / 10 | |
| 1.43.6 | 16 / 10 | |
| 1.43.5 | 16 / 10 | |
| 1.43.4 | 16 / 10 | |
| 1.43.0 | 16 / 10 | |
| 1.42.1 | 16 / 10 | |
| 1.33.0 | 10 / 10 | |
| 1.32.4 | 9 / 9 | |
| 1.32.3 | 9 / 9 | |
| 1.32.1 | 9 / 9 |
v1.46.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.46.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.46.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.46.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.46.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.44.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.43.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.42.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.33.0
10 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.32.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.32.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.32.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.