@herb-tools/formatter
Auto-formatter for HTML+ERB templates with intelligent indentation, line wrapping, and ERB-aware pretty-printing.
35
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
marcoroth
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/herb-format.js | AI (source-diff): Rollup CJS bundle with standard helpers; not obfuscated. Stable for this package. | ai | |
| source-diff | encoded-string-file:dist/herb-format.js | AI (source-diff): Base64 string is an inline WASM binary (Emscripten-compiled parser); standard pattern for this package. Stable across versions. | ai | |
| dependencies | unvetted-dep:@herb-tools/printer | AI (dependencies): First-party sibling package from the same herb monorepo, pinned to matching version. Not a third-party supply chain risk. | ai | |
| dependencies | unvetted-dep:@herb-tools/core | AI (dependencies): First-party sibling package from the same herb monorepo, pinned to matching version. Not a third-party supply chain risk. | ai | |
| provenance | no-provenance | AI (provenance): Lack of provenance is common (~88% of npm packages); no other risk signals present to elevate this concern for this package. | ai | |
| dependencies | unvetted-dep:@herb-tools/rewriter | AI (dependencies): First-party sibling package from the same herb monorepo, pinned to matching version. Not a third-party supply chain risk. | ai | |
| dependencies | unvetted-dep:@herb-tools/config | AI (dependencies): First-party sibling package from the same herb monorepo, pinned to matching version. Not a third-party supply chain risk. | ai |
Versions (showing 35 of 35)
| Version | Deps | Published |
|---|---|---|
| 0.10.2 | 5 / 0 | |
| 0.10.1 | 5 / 0 | |
| 0.10.0 | 5 / 0 | |
| 0.9.7 | 5 / 0 | |
| 0.9.6 | 5 / 0 | |
| 0.9.5 | 5 / 0 | |
| 0.9.4 | 5 / 0 | |
| 0.9.3 | 5 / 0 | |
| 0.9.2 | 5 / 0 | |
| 0.9.1 | 5 / 0 | |
| 0.9.0 | 5 / 0 | |
| 0.8.10 | 5 / 0 | |
| 0.8.9 | 5 / 0 | |
| 0.8.8 | 5 / 0 | |
| 0.8.7 | 5 / 0 | |
| 0.8.6 | 4 / 0 | |
| 0.8.5 | 4 / 0 | |
| 0.8.4 | 4 / 0 | |
| 0.8.3 | 4 / 0 | |
| 0.8.2 | 4 / 0 | |
| 0.8.1 | 4 / 0 | |
| 0.8.0 | 4 / 0 | |
| 0.7.5 | 2 / 1 | |
| 0.7.4 | 2 / 1 | |
| 0.7.3 | 2 / 1 | |
| 0.7.2 | 2 / 1 | |
| 0.7.1 | 2 / 1 | |
| 0.7.0 | 2 / 1 | |
| 0.6.1 | 2 / 1 | |
| 0.6.0 | 2 / 1 | |
| 0.5.0 | 2 / 0 | |
| 0.4.3 | 2 / 0 | |
| 0.4.2 | 2 / 0 | |
| 0.4.1 | 2 / 0 | |
| 0.4.0 | 1 / 0 |
v0.10.2
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.