@jupyterlab/apputils — Greenflagged

JupyterLab - Application Utilities

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

darianjasongroutjtpiokrassowskijupyterlab-release-bot

Keywords

jupyterjupyterlabjupyterlab-extension

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
phantom-deps	phantom-dep:@jupyterlab/coreutils	AI (phantom-deps): Same org scope (@jupyterlab); likely used indirectly or re-exported. Stable false positive for this package.	ai	2026/04/24
phantom-deps	phantom-dep:@types/sanitize-html	AI (phantom-deps): Type-only dependency used at compile time, not directly imported at runtime; stable false positive for this package.	ai	2026/04/24
dependencies	unvetted-dep:@types/sanitize-html	AI (dependencies): @types/sanitize-html is a TypeScript type definition package for the already-declared sanitize-html runtime dep; its presence as a dependency is a benign early-TypeScript pattern for this package.	ai	2026/04/24
provenance	publisher-changed	AI (provenance): jtpio is a well-known JupyterLab core contributor with 1696 approved packages; publisher change from jasongrout is a legitimate project maintainer transition.	ai	2026/04/23
maintainer-change	maintainer-added	AI (maintainer-change): New maintainers (krassowski, goanpeca, mbektas, loichuder) are known JupyterLab contributors; this is a normal team expansion for an active open-source project.	ai	2026/04/23
provenance	missing-githead	AI (provenance): Missing gitHead is consistent with a CI/tooling change during maintainer transition; no malware indicators present.	ai	2026/04/23
phantom-deps	phantom-dep:buffer	AI (phantom-deps): Buffer polyfill is a standard pattern for browser-targeting libraries; declared for build/bundler use.	ai	2026/04/23
provenance	no-provenance	AI (provenance): Provenance is uncommon (12% adoption); not a material risk for established JupyterLab package.	ai	2026/04/23
phantom-deps	phantom-dep:url	AI (phantom-deps): url is a well-known Node.js URL polyfill; phantom detection in config files is a stable false positive for this package.	ai	2026/04/23
publish-pattern	new-deps-added	AI (publish-pattern): Diff is cross-major-branch (3.x vs 4.x); added deps are well-known Lumino/React packages consistent with JupyterLab 3.x dependency surface. Not a suspicious addition.	ai	2026/04/23
maintainer-change	maintainer-removed	AI (maintainer-change): JupyterLab uses a centralized release bot (jupyterlab-release-bot) for publishing; individual maintainer removals are expected organizational changes, not takeover indicators.	ai	2026/04/23
dependencies	unvetted-dep:@jupyterlab/services	AI (dependencies): First-party JupyterLab package from the same monorepo; stable long-term dependency.	ai	2026/04/23
dependencies	unvetted-dep:@jupyterlab/coreutils	AI (dependencies): First-party JupyterLab package from the same monorepo; stable long-term dependency.	ai	2026/04/23
dependencies	unvetted-dep:@jupyterlab/observables	AI (dependencies): First-party JupyterLab package from the same monorepo; stable long-term dependency.	ai	2026/04/23
dependencies	unvetted-dep:@jupyterlab/translation	AI (dependencies): First-party JupyterLab package from the same monorepo; stable long-term dependency.	ai	2026/04/23
dependencies	unvetted-dep:@jupyterlab/ui-components	AI (dependencies): First-party JupyterLab package from the same monorepo; stable long-term dependency.	ai	2026/04/23
dependencies	unvetted-dep:@jupyterlab/settingregistry	AI (dependencies): First-party JupyterLab package from the same monorepo; stable long-term dependency.	ai	2026/04/23
dependencies	unvetted-dep:@jupyterlab/rendermime-interfaces	AI (dependencies): First-party JupyterLab package from the same monorepo; stable long-term dependency.	ai	2026/04/23
dependencies	unvetted-dep:@jupyterlab/statusbar	AI (dependencies): First-party JupyterLab package from the same monorepo; stable long-term dependency.	ai	2026/04/23
dependencies	unvetted-dep:@lumino/widgets	AI (dependencies): First-party Lumino package from the JupyterLab ecosystem monorepo; stable long-term dependency.	ai	2026/04/23
dependencies	unvetted-dep:@lumino/commands	AI (dependencies): First-party Lumino package from the JupyterLab ecosystem monorepo; stable long-term dependency.	ai	2026/04/23
dependencies	unvetted-dep:@lumino/domutils	AI (dependencies): First-party Lumino package from the JupyterLab ecosystem monorepo; stable long-term dependency.	ai	2026/04/23
dependencies	unvetted-dep:@lumino/algorithm	AI (dependencies): First-party Lumino package from the JupyterLab ecosystem monorepo; stable long-term dependency.	ai	2026/04/23
dependencies	unvetted-dep:@lumino/coreutils	AI (dependencies): First-party Lumino package from the JupyterLab ecosystem monorepo; stable long-term dependency.	ai	2026/04/23
dependencies	unvetted-dep:@lumino/messaging	AI (dependencies): First-party Lumino package from the JupyterLab ecosystem monorepo; stable long-term dependency.	ai	2026/04/23
dependencies	unvetted-dep:@lumino/signaling	AI (dependencies): First-party Lumino package from the JupyterLab ecosystem monorepo; stable long-term dependency.	ai	2026/04/23
dependencies	unvetted-dep:@lumino/disposable	AI (dependencies): First-party Lumino package from the JupyterLab ecosystem monorepo; stable long-term dependency.	ai	2026/04/23
dependencies	unvetted-dep:@lumino/virtualdom	AI (dependencies): First-party Lumino package from the JupyterLab ecosystem monorepo; stable long-term dependency.	ai	2026/04/23
dependencies	unvetted-dep:@jupyterlab/statedb	AI (dependencies): First-party JupyterLab package from the same monorepo; stable long-term dependency.	ai	2026/04/23
dependencies	unvetted-dep:sanitize-html	AI (dependencies): sanitize-html is a well-known HTML sanitization library; its use in a JupyterLab UI utilities package is legitimate and expected. No advisories affect the pinned range.	ai	2026/04/23
bogus-package	bogus-package	AI (bogus-package): JupyterLab monorepo packages always publish at coordinated high semver versions and have minimal sub-package READMEs. These signals are structural false positives for this package.	ai	2026/04/21
phantom-deps	phantom-dep:@types/react	AI (phantom-deps): @types/react is intentionally listed as a runtime dep in JupyterLab packages for type-sharing conventions; not a security concern.	ai	2026/04/21