@docusaurus/bundler
Docusaurus util package to abstract the current bundler.
15
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
fbslorberlex111docusaurus-bot
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | no-provenance | AI (provenance): Canary releases from established publishers often lack provenance; not a concern for this trusted monorepo package. | ai | |
| dependencies | unvetted-dep:babel-loader | AI (dependencies): babel-loader is a standard webpack loader; expected dependency for a bundler utility. | ai | |
| dependencies | unvetted-peer-dep:@docusaurus/faster | AI (dependencies): Optional peer dependency for Docusaurus framework; marked optional in peerDependenciesMeta. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Bundler expansion with new build features; 21 files is expected for this package's scope. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase reflects legitimate bundler feature expansion, not injected code. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): 18 new deps are canonical build tools (webpack, babel, postcss, terser, etc.); expected for bundler package. | ai | |
| provenance | publisher-changed | AI (provenance): Legitimate CI/CD transition from docusaurus-bot to GitHub Actions; SLSA provenance attestation confirms integrity. | ai | |
| dependencies | unvetted-dep:webpack | AI (dependencies): Webpack is a canonical, widely-trusted bundler; appropriate core dependency for this package. | ai | |
| phantom-deps | phantom-dep:clean-css | AI (phantom-deps): Bundler package; clean-css is referenced in webpack config, not direct import. Stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:@babel/core | AI (phantom-deps): Framework-scoped package loaded by convention in bundler context. Stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:cssnano | AI (phantom-deps): Bundler package; cssnano is referenced in webpack config, not direct import. Stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:postcss | AI (phantom-deps): Bundler package; postcss is referenced in webpack config, not direct import. Stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:url-loader | AI (phantom-deps): Bundler package; url-loader is referenced in webpack config, not direct import. Stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:file-loader | AI (phantom-deps): Bundler package; file-loader is referenced in webpack config, not direct import. Stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:@docusaurus/utils | AI (phantom-deps): Same-org scoped package in monorepo; loaded by convention. Stable pattern for this package. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Internal Docusaurus monorepo package; 'fb' spam signal is false positive (Facebook org owner). README and keyword signals are expected for framework-internal utilities. | ai |
Versions (showing 15 of 15)
| Version | Deps | Published |
|---|---|---|
| 3.10.2 | 24 / 1 | |
| 3.10.1 | 24 / 1 | |
| 3.10.0 | 24 / 1 | |
| 3.9.2 | 24 / 1 | |
| 3.9.1 | 24 / 1 | |
| 3.9.0 | 24 / 1 | |
| 3.8.1 | 24 / 1 | |
| 3.8.0 | 24 / 1 | |
| 3.7.0 | 25 / 1 | |
| 3.6.3 | 25 / 1 | |
| 3.6.2 | 25 / 1 | |
| 3.6.1 | 25 / 1 | |
| 3.6.0 | 25 / 1 | |
| 3.5.2 | 7 / 0 | |
| 3.8.1-canary-6388 | 24 / 1 |
v3.10.2
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.