← Home

@jupyterlab/coreutils

npm Repository Homepage

JupyterLab - Core Utilities

51
Versions
BSD-3-Clause
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

darianjasongroutjtpiokrassowskijupyterlab-release-bot

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
dependencies unvetted-dep:path-posix AI (dependencies): path-posix is a well-known, stable POSIX path utility. No security concerns with this dependency. ai
semgrep semgrep:eval-usage AI (semgrep): eval('require') in pageconfig.js is a documented Webpack trick to prevent static analysis of dynamic require calls — a stable, legitimate pattern in this package. ai
phantom-deps phantom-dep:path-browserify AI (phantom-deps): path-browserify is declared in the browser field as a path module substitute — not directly imported in JS but legitimately referenced in package.json config. ai
bogus-package bogus-package AI (bogus-package): Inflated semver reflects JupyterLab monorepo versioning convention; short README and no keywords are quality issues, not security signals. SLSA provenance confirms legitimate CI/CD origin. ai

Versions (showing 51 of 186)

View all versions
Version Deps Published
6.6.2 6 / 11
6.6.1 6 / 11
6.6.0 6 / 11
6.5.10 6 / 11
6.5.9 6 / 11
6.5.8 6 / 11
6.5.7 6 / 11
6.5.6 6 / 11
6.5.5 6 / 11
6.5.4 6 / 11
6.5.3 6 / 11
6.5.2 6 / 11
6.5.1 6 / 11
6.5.0 6 / 11
6.4.10 6 / 11
6.4.9 6 / 11
6.4.8 6 / 11
6.4.7 6 / 11
6.4.6 6 / 11
6.4.5 6 / 11
6.4.4 6 / 11
6.4.3 6 / 11
6.4.2 6 / 11
6.4.1 6 / 11
6.4.0 6 / 11
6.3.8 6 / 11
6.3.7 6 / 11
6.3.6 6 / 11
6.3.5 6 / 11
6.3.4 6 / 11
6.3.3 6 / 11
6.3.2 6 / 11
6.3.1 6 / 11
6.3.0 6 / 11
6.2.7 6 / 11
6.2.6 6 / 11
6.2.5 6 / 11
6.2.4 6 / 11
6.2.3 6 / 11
6.2.2 6 / 11
6.2.1 6 / 11
6.2.0 6 / 11
6.1.8 6 / 12
6.1.7 6 / 12
6.1.6 6 / 12
6.1.5 6 / 12
6.1.4 6 / 12
6.1.3 6 / 12
6.1.2 6 / 12
6.1.1 6 / 12
6.1.0 6 / 12

v6.6.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.6.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.5.10

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.5.6

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.