@foxglove/cdr

Supply chain provenance

Status for the latest visible version.

Maintainers

Keywords

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	encoded-string-file:dist/CdrWriter.test.js	AI (source-diff): Same tf2_msgs/TFMessage hex fixture used in writer tests; benign test data.	ai	2026/05/26
source-diff	encoded-string-file:src/CdrWriter.test.ts	AI (source-diff): Same hex fixture in TypeScript source; benign test data.	ai	2026/05/26
provenance	publisher-changed	AI (provenance): Transition to GitHub Actions publisher with SLSA provenance attestation is a legitimate CI/CD migration.	ai	2026/05/26
source-diff	encoded-string-file:dist/CdrReader.test.js	AI (source-diff): Hex string is a ROS2 CDR binary test fixture with fully annotated field assertions; not obfuscation.	ai	2026/05/26
source-diff	encoded-string-file:src/CdrReader.test.ts	AI (source-diff): Same hex fixture in TypeScript source; benign test data.	ai	2026/05/26
semgrep	semgrep:hex-decode	AI (semgrep): Hex decoding is in test files only, decoding known ROS2 message fixtures — not a runtime payload risk.	ai	2026/05/19
typosquat	typosquat.levenshtein:cors	AI (typosquat): Scoped @foxglove/cdr is a CDR serialization lib; no plausible typosquat relationship to 'cors'.	ai	2026/05/19

Version	Deps	Published
3.5.1	0 / 16	2026-05-25
3.5.0	0 / 16	2025-08-28
3.4.0	0 / 16	2025-07-16