@epic-web/workshop-utils
Shared utilities for the Epic Workshop ecosystem.
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/launch-editor.server.js | AI (source-diff): File is readable source copied from CRA's launchEditor.js; long lines are editor-path maps, not obfuscation. | ai | |
| provenance | publisher-changed | AI (provenance): Package publishes via GitHub Actions CI with SLSA attestation; kentcdodds→GHA is the expected automated publishing transition. | ai | |
| source-diff | obfuscated-file:dist/esm/launch-editor.server.js | AI (source-diff): Long lines are from a large object literal (editor path map), not obfuscation; code is readable and sourced from create-react-app. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): shell-quote is a well-known safe argument-quoting utility, directly used in launch-editor.server.js. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Utility library for epicshop workshop tooling; sparse README/no keywords is a style choice, not a spam signal. | ai | |
| dependencies | unvetted-dep:@types/chai | AI (dependencies): TypeScript type definitions package; no runtime risk. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): SLSA provenance attestation via GitHub Actions CI/CD mitigates account-takeover risk; no material changes from prior version. | ai | |
| dependencies | unvetted-dep:@react-router/node | AI (dependencies): Official @react-router scoped package from the React Router ecosystem; legitimate dependency. | ai | |
| phantom-deps | phantom-dep:@types/chai | AI (phantom-deps): Framework-scoped type package; loaded by convention. | ai | |
| phantom-deps | phantom-dep:@types/chai-dom | AI (phantom-deps): Framework-scoped type package; loaded by convention. | ai | |
| phantom-deps | phantom-dep:react | AI (phantom-deps): Workshop utils package; react is a peer/config-referenced dep, not directly imported in source. | ai | |
| phantom-deps | phantom-dep:mdast-util-mdx-jsx | AI (phantom-deps): MDX AST utility; used via plugin chain, not direct import. | ai | |
| phantom-deps | phantom-dep:unist-util-remove-position | AI (phantom-deps): Unist utility; used via plugin chain, not direct import. | ai | |
| phantom-deps | phantom-dep:@react-router/node | AI (phantom-deps): Config-referenced dep; stable false positive for this workshop utils package. | ai | |
| phantom-deps | phantom-dep:pkgmgr | AI (phantom-deps): Referenced in config files; consistent with workshop tooling pattern. | ai | |
| phantom-deps | phantom-dep:rehype | AI (phantom-deps): MDX/markdown processing dep used via config/plugin chain, not direct import. | ai | |
| phantom-deps | phantom-dep:remark | AI (phantom-deps): MDX/markdown processing dep used via config/plugin chain, not direct import. | ai | |
| phantom-deps | phantom-dep:esbuild | AI (phantom-deps): Known implicit runtime/binary dependency; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:unified | AI (phantom-deps): MDX pipeline dep; loaded by convention, not direct import. | ai | |
| phantom-deps | phantom-dep:react-dom | AI (phantom-deps): Config-referenced peer dep; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@mdx-js/mdx | AI (phantom-deps): MDX compilation dep; used via config, not direct import. | ai |
Versions (showing 100 of 258)
| Version | Deps | Published |
|---|---|---|
| 6.90.18 | 51 / 8 | |
| 6.90.17 | 51 / 8 | |
| 6.90.16 | 51 / 8 | |
| 6.90.15 | 51 / 8 | |
| 6.90.14 | 51 / 8 | |
| 6.90.13 | 51 / 8 | |
| 6.90.12 | 51 / 8 | |
| 6.90.11 | 51 / 8 | |
| 6.90.10 | 51 / 8 | |
| 6.90.9 | 51 / 8 | |
| 6.90.8 | 51 / 8 | |
| 6.90.7 | 51 / 8 | |
| 6.90.6 | 51 / 8 | |
| 6.90.5 | 51 / 8 | |
| 6.90.4 | 51 / 8 | |
| 6.90.3 | 51 / 8 | |
| 6.90.2 | 51 / 8 | |
| 6.90.1 | 51 / 8 | |
| 6.90.0 | 51 / 8 | |
| 6.89.5 | 51 / 8 | |
| 6.89.4 | 51 / 8 | |
| 6.89.3 | 51 / 8 | |
| 6.89.2 | 51 / 8 | |
| 6.89.1 | 51 / 8 | |
| 6.89.0 | 51 / 8 | |
| 6.88.1 | 51 / 8 | |
| 6.88.0 | 51 / 8 | |
| 6.87.5 | 51 / 8 | |
| 6.87.4 | 51 / 8 | |
| 6.87.3 | 51 / 8 | |
| 6.87.2 | 51 / 8 | |
| 6.87.1 | 51 / 8 | |
| 6.87.0 | 51 / 8 | |
| 6.86.0 | 51 / 8 | |
| 6.85.5 | 51 / 8 | |
| 6.85.4 | 52 / 8 | |
| 6.85.3 | 52 / 8 | |
| 6.85.2 | 52 / 8 | |
| 6.85.1 | 52 / 8 | |
| 6.85.0 | 52 / 8 | |
| 6.84.8 | 52 / 8 | |
| 6.84.7 | 52 / 8 | |
| 6.84.6 | 52 / 8 | |
| 6.84.5 | 52 / 8 | |
| 6.84.4 | 52 / 8 | |
| 6.84.3 | 52 / 8 | |
| 6.84.2 | 52 / 8 | |
| 6.84.1 | 52 / 8 | |
| 6.84.0 | 52 / 8 | |
| 6.83.0 | 52 / 8 | |
| 6.82.1 | 52 / 8 | |
| 6.82.0 | 52 / 8 | |
| 6.81.0 | 52 / 8 | |
| 6.80.2 | 52 / 8 | |
| 6.80.1 | 52 / 8 | |
| 6.80.0 | 52 / 8 | |
| 6.79.0 | 52 / 8 | |
| 6.78.3 | 52 / 8 | |
| 6.78.2 | 52 / 8 | |
| 6.78.1 | 52 / 8 | |
| 6.78.0 | 52 / 8 | |
| 6.77.2 | 52 / 8 | |
| 6.77.1 | 52 / 8 | |
| 6.77.0 | 52 / 8 | |
| 6.76.7 | 52 / 8 | |
| 6.76.6 | 52 / 8 | |
| 6.76.5 | 52 / 8 | |
| 6.76.4 | 52 / 8 | |
| 6.76.3 | 52 / 8 | |
| 6.76.2 | 52 / 8 | |
| 6.76.1 | 52 / 8 | |
| 6.75.1 | 52 / 8 | |
| 6.75.0 | 52 / 8 | |
| 6.74.3 | 52 / 8 | |
| 6.74.2 | 52 / 8 | |
| 6.74.1 | 52 / 8 | |
| 6.74.0 | 52 / 8 | |
| 6.72.1 | 52 / 8 | |
| 6.71.2 | 52 / 8 | |
| 6.71.1 | 52 / 8 | |
| 6.71.0 | 52 / 8 | |
| 6.70.0 | 52 / 8 | |
| 6.69.1 | 52 / 8 | |
| 6.69.0 | 52 / 8 | |
| 6.68.0 | 51 / 8 | |
| 6.65.0 | 51 / 8 | |
| 6.63.0 | 51 / 8 | |
| 6.62.0 | 51 / 8 | |
| 6.61.4 | 51 / 8 | |
| 6.61.2 | 51 / 8 | |
| 6.61.1 | 51 / 8 | |
| 6.61.0 | 51 / 8 | |
| 6.60.0 | 51 / 8 | |
| 6.58.0 | 51 / 8 | |
| 6.57.0 | 51 / 8 | |
| 6.55.0 | 51 / 8 | |
| 6.54.1 | 51 / 8 | |
| 6.54.0 | 51 / 8 | |
| 6.53.1 | 51 / 8 | |
| 6.51.1 | 51 / 8 |
v6.90.18
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.90.17
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.90.16
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.90.15
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.90.14
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.90.13
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.90.12
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.90.11
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.90.10
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.90.9
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.