@jupyterlab/builder — Greenflagged

JupyterLab - Extension Builder

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

darianblink1073jasongroutfcollonvaljtpiombektaskrassowskijupyterlab-release-bot

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
semgrep	semgrep:dynamic-require	AI (semgrep): Pattern loads package.json from a caller-supplied path — standard extension builder behavior, not arbitrary module loading.	ai	2026/05/02
phantom-deps	phantom-dep:webpack-cli	AI (phantom-deps): Declared as runtime dep for downstream consumers; not directly imported by builder itself.	ai	2026/05/02
phantom-deps	phantom-dep:worker-loader	AI (phantom-deps): Declared as runtime dep for downstream consumers; not directly imported by builder itself.	ai	2026/05/02
phantom-deps	phantom-dep:@lumino/widgets	AI (phantom-deps): Peer/runtime dep for JupyterLab extension consumers; stable false positive for this package.	ai	2026/05/02
phantom-deps	phantom-dep:@lumino/commands	AI (phantom-deps): Peer/runtime dep for JupyterLab extension consumers; stable false positive for this package.	ai	2026/05/02
phantom-deps	phantom-dep:@lumino/domutils	AI (phantom-deps): Peer/runtime dep for JupyterLab extension consumers; stable false positive for this package.	ai	2026/05/02
phantom-deps	phantom-dep:@lumino/dragdrop	AI (phantom-deps): Peer/runtime dep for JupyterLab extension consumers; stable false positive for this package.	ai	2026/05/02
phantom-deps	phantom-dep:@lumino/algorithm	AI (phantom-deps): Peer/runtime dep for JupyterLab extension consumers; stable false positive for this package.	ai	2026/05/02
phantom-deps	phantom-dep:@lumino/coreutils	AI (phantom-deps): Peer/runtime dep for JupyterLab extension consumers; stable false positive for this package.	ai	2026/05/02
phantom-deps	phantom-dep:@lumino/messaging	AI (phantom-deps): Peer/runtime dep for JupyterLab extension consumers; stable false positive for this package.	ai	2026/05/02
phantom-deps	phantom-dep:@lumino/signaling	AI (phantom-deps): Peer/runtime dep for JupyterLab extension consumers; stable false positive for this package.	ai	2026/05/02
phantom-deps	phantom-dep:@lumino/disposable	AI (phantom-deps): Peer/runtime dep for JupyterLab extension consumers; stable false positive for this package.	ai	2026/05/02
phantom-deps	phantom-dep:@lumino/properties	AI (phantom-deps): Peer/runtime dep for JupyterLab extension consumers; stable false positive for this package.	ai	2026/05/02
phantom-deps	phantom-dep:@lumino/virtualdom	AI (phantom-deps): Peer/runtime dep for JupyterLab extension consumers; stable false positive for this package.	ai	2026/05/02
phantom-deps	phantom-dep:@lumino/application	AI (phantom-deps): Peer/runtime dep for JupyterLab extension consumers; stable false positive for this package.	ai	2026/05/02
phantom-deps	phantom-dep:terser-webpack-plugin	AI (phantom-deps): Declared as runtime dep for downstream consumers; not directly imported by builder itself.	ai	2026/05/02
bogus-package	bogus-package	AI (bogus-package): Well-known JupyterLab project package; README/keyword signals are false positives.	ai	2026/05/02