@docusaurus/plugin-content-blog
Blog plugin for Docusaurus.
30
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
fbslorberlex111docusaurus-bot
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| bogus-package | bogus-package | AI (bogus-package): Spam signals are false positives: 'fb' is the legitimate Facebook/Docusaurus org, not spam; missing keywords is metadata-only for an established monorepo package. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher transition from slorber to docusaurus-bot is a documented, legitimate org change within Docusaurus governance. | ai | |
| provenance | no-provenance | AI (provenance): Provenance attestation is a best-practice recommendation, not a security blocker for established projects. | ai | |
| source-diff | large-new-source-files | AI (source-diff): 22 new source files are consistent with normal feature development in an active monorepo; no bundled/injected code indicators. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): schema-dts is a legitimate, established dependency addition for blog plugin functionality. | ai | |
| phantom-deps | phantom-dep:@docusaurus/core | AI (phantom-deps): Expected phantom dependency pattern for plugins within the same monorepo scope. | ai | |
| dependencies | unvetted-dep:schema-dts | AI (dependencies): schema-dts is an established, legitimate JSON-LD schema package; appropriate for blog plugin content handling. | ai | |
| dependencies | unvetted-dep:srcset | AI (dependencies): srcset is a standard, widely-used srcset parser; no security concerns for this package. | ai | |
| dependencies | unvetted-dep:unist-util-visit | AI (dependencies): unist-util-visit is a standard AST traversal utility used in content processing; appropriate for blog plugin. | ai | |
| dependencies | unvetted-dep:webpack | AI (dependencies): Webpack is a standard build dependency for Docusaurus plugins; appropriate for this package's purpose. | ai | |
| dependencies | unvetted-dep:feed | AI (dependencies): feed is a well-known RSS/Atom feed generator; legitimate and expected dependency for a blog plugin. | ai |
Versions (showing 30 of 30)
| Version | Deps | Published |
|---|---|---|
| 3.10.2 | 19 / 2 | |
| 3.10.1 | 19 / 2 | |
| 3.9.2 | 18 / 2 | |
| 3.7.0 | 18 / 2 | |
| 3.6.3 | 18 / 2 | |
| 3.6.2 | 18 / 2 | |
| 3.6.1 | 18 / 2 | |
| 3.6.0 | 18 / 2 | |
| 3.5.2 | 18 / 2 | |
| 3.5.1 | 18 / 2 | |
| 3.5.0 | 18 / 2 | |
| 3.4.0 | 17 / 1 | |
| 3.3.2 | 17 / 1 | |
| 3.3.1 | 17 / 1 | |
| 3.3.0 | 17 / 1 | |
| 3.2.1 | 17 / 1 | |
| 3.2.0 | 17 / 1 | |
| 3.1.1 | 17 / 0 | |
| 3.1.0 | 17 / 0 | |
| 3.0.1 | 17 / 0 | |
| 3.0.0 | 17 / 0 | |
| 2.4.3 | 16 / 0 | |
| 2.4.1 | 16 / 0 | |
| 2.4.0 | 16 / 0 | |
| 2.3.1 | 16 / 0 | |
| 2.3.0 | 16 / 0 | |
| 2.2.0 | 16 / 1 | |
| 2.1.0 | 16 / 1 | |
| 2.0.1 | 16 / 2 | |
| 2.0.0 | 16 / 2 |
v3.10.2
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.