← Home

@fundamental-ngx/cdk

npm Repository Homepage

Fundamental Library for Angular - CDK

42
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

fundamental-ui

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
publish-pattern new-deps-added AI (publish-pattern): fast-equals is a well-known equality lib replacing fast-deep-equal; benign swap. ai
source-diff obfuscated-file:types/fundamental-ngx-cdk-utils.d.ts AI (source-diff): Long lines in .d.ts files are normal for bundled Angular type declarations; not obfuscation. ai
source-diff obfuscated-file:utils/index.d.ts AI (source-diff): TypeScript declaration files for Angular libraries produce long lines from complex type unions; not obfuscation. ai
phantom-deps phantom-dep:@fundamental-ngx/i18n AI (phantom-deps): Same-org sibling dep; phantom detection is a false positive here. ai
dependencies unvetted-dep:@fundamental-styles/cx AI (dependencies): SAP sibling package in the fundamental-styles ecosystem; stable dependency across versions. ai
phantom-deps phantom-dep:tslib AI (phantom-deps): tslib is a well-known Angular/TypeScript implicit runtime dep; stable false positive for this package. ai
phantom-deps phantom-dep:compare-versions AI (phantom-deps): Declared dep used in build/config context; stable false positive for this package. ai
phantom-deps phantom-dep:@sap-theming/theming-base-content AI (phantom-deps): SAP theming asset dep; referenced in config, stable false positive for this package. ai
phantom-deps phantom-dep:@fundamental-styles/cx AI (phantom-deps): First-party SAP styling dep; referenced in config/styles, stable false positive. ai
phantom-deps phantom-dep:fundamental-styles AI (phantom-deps): First-party SAP styling dep; referenced in config/styles, stable false positive. ai
phantom-deps phantom-dep:lodash-es AI (phantom-deps): Angular library; lodash-es likely tree-shaken/used indirectly in build output, stable false positive for this package. ai

Versions (showing 42 of 42)

Version Deps Published
0.63.1 8 / 0
0.63.0 8 / 0
0.62.3 8 / 0
0.62.1 8 / 0
0.61.3 8 / 0
0.61.2 8 / 0
0.61.1 8 / 0
0.60.3 8 / 0
0.59.2 8 / 0
0.59.1 8 / 0
0.58.10 8 / 0
0.58.9 8 / 0
0.58.7 8 / 0
0.58.6 8 / 0
0.58.5 8 / 0
0.57.12 8 / 0
0.57.10 8 / 0
0.57.9 8 / 0
0.57.6 8 / 0
0.57.4 8 / 0
0.57.3 8 / 0
0.57.2 8 / 0
0.57.1 8 / 0
0.57.0 8 / 0
0.56.8 8 / 0
0.56.6 8 / 0
0.56.5 8 / 0
0.56.3 8 / 0
0.56.2 8 / 0
0.56.1 8 / 0
0.55.10 8 / 0
0.55.8 8 / 0
0.55.7 8 / 0
0.54.6 8 / 0
0.54.5 8 / 0
0.54.4 8 / 0
0.53.5 8 / 0
0.53.4 8 / 0
0.43.61 9 / 0
0.43.59 9 / 0
0.43.56 9 / 0
0.43.54 9 / 0

v0.63.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.58.10

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.58.9

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.58.5

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.