← Home

@jupyterlab/services

npm Repository Homepage

Client APIs for the Jupyter services REST APIs

100
Versions
BSD-3-Clause
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

darianjasongroutjtpiokrassowskijupyterlab-release-bot

Keywords

jupyternotebookservices

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
phantom-deps phantom-dep:ws AI (phantom-deps): ws is a legitimate runtime dependency used for WebSocket support; phantom-dep fires due to dynamic/conditional import patterns in this isomorphic library. ai
phantom-deps phantom-dep:node-fetch AI (phantom-deps): node-fetch is loaded via eval('require')('node-fetch') to avoid bundler inclusion; static analysis cannot detect this dynamic import. Legitimate runtime dependency. ai
semgrep semgrep:eval-usage AI (semgrep): eval('require') is a hardcoded static string used to conditionally load node-fetch in Node.js environments without bundler interference — a well-known legitimate isomorphic pattern with no dynamic input. ai
phantom-deps phantom-dep:@types/text-encoding AI (phantom-deps): Type-only package used for TypeScript compilation; not directly imported at runtime is expected behavior for @types packages. ai
provenance no-provenance AI (provenance): This is a legacy version predating npm provenance attestation; absence is expected and not a risk signal for this well-established package. ai
dependencies unvetted-dep:@types/text-encoding AI (dependencies): @types/text-encoding is a TypeScript type definition package with no runtime code; it poses no security risk for this package. ai
phantom-deps phantom-dep:@types/minimist AI (phantom-deps): @types/minimist as a runtime dep is a harmless quirk of older TypeScript project conventions; no security implication. ai
dependencies unvetted-dep:phosphor AI (dependencies): phosphor was the official predecessor UI framework for JupyterLab; its use in early @jupyterlab/services versions is expected and legitimate. ai
provenance publisher-changed AI (provenance): Migration from jupyterlab-release-bot to GitHub Actions OIDC publishing with SLSA provenance; legitimate CI/CD infrastructure change for the JupyterLab project. ai
dependencies unvetted-dep:@jupyterlab/coreutils AI (dependencies): Known JupyterLab sibling package; expected dependency for @jupyterlab/services. ai
bogus-package bogus-package AI (bogus-package): Inflated semver is expected for JupyterLab monorepo packages published at their monorepo version. README signal is a false positive for this legitimate Project Jupyter package. ai
dependencies unvetted-dep:@jupyterlab/settingregistry AI (dependencies): Known JupyterLab sibling package; expected dependency for @jupyterlab/services. ai
dependencies unvetted-dep:@jupyter/ydoc AI (dependencies): Known JupyterLab ecosystem dependency; expected transitive dep for this package. ai
dependencies unvetted-dep:@lumino/polling AI (dependencies): Known Lumino ecosystem dependency; expected for @jupyterlab/services. ai
dependencies unvetted-dep:@lumino/coreutils AI (dependencies): Known Lumino ecosystem dependency; expected for @jupyterlab/services. ai
dependencies unvetted-dep:@lumino/signaling AI (dependencies): Known Lumino ecosystem dependency; expected for @jupyterlab/services. ai
dependencies unvetted-dep:@lumino/disposable AI (dependencies): Known Lumino ecosystem dependency; expected for @jupyterlab/services. ai
dependencies unvetted-dep:@lumino/properties AI (dependencies): Known Lumino ecosystem dependency; expected for @jupyterlab/services. ai
dependencies unvetted-dep:@jupyterlab/statedb AI (dependencies): Known JupyterLab sibling package; expected dependency for @jupyterlab/services. ai
dependencies unvetted-dep:@jupyterlab/nbformat AI (dependencies): Known JupyterLab sibling package; expected dependency for @jupyterlab/services. ai

Versions (showing 100 of 221)

Version Deps Published
7.6.2 11 / 7
7.6.1 11 / 7
7.6.0 11 / 7
7.5.10 11 / 8
7.5.8 11 / 8
7.5.7 11 / 8
7.5.6 11 / 8
7.5.5 11 / 8
7.5.4 11 / 8
7.5.3 11 / 8
7.5.2 11 / 8
7.5.1 11 / 8
7.5.0 11 / 8
7.4.10 11 / 8
7.4.9 11 / 8
7.4.8 11 / 8
7.4.7 11 / 8
7.4.6 11 / 8
7.4.5 11 / 8
7.4.4 11 / 8
7.4.3 11 / 8
7.4.2 11 / 8
7.4.1 11 / 8
7.4.0 11 / 8
7.3.8 11 / 8
7.3.7 11 / 8
7.3.6 11 / 8
7.3.5 11 / 8
7.3.4 11 / 8
7.3.3 11 / 8
7.3.2 11 / 8
7.3.1 11 / 8
7.3.0 11 / 8
7.2.7 11 / 8
7.2.6 11 / 8
7.2.5 11 / 8
7.2.4 11 / 8
7.2.3 11 / 8
7.2.2 11 / 8
7.2.1 11 / 8
7.2.0 11 / 8
7.1.8 11 / 9
7.1.7 11 / 9
7.1.6 11 / 9
7.1.5 11 / 9
7.1.4 11 / 9
7.1.3 11 / 9
7.1.2 11 / 9
7.1.1 11 / 9
7.1.0 11 / 9
7.0.13 11 / 9
7.0.12 11 / 9
7.0.11 11 / 9
7.0.10 11 / 9
7.0.9 11 / 9
7.0.8 11 / 9
7.0.7 11 / 9
7.0.6 11 / 9
7.0.5 11 / 9
7.0.4 11 / 9
7.0.3 11 / 9
7.0.2 11 / 9
7.0.1 11 / 9
7.0.0 11 / 9
6.6.8 12 / 13
6.6.6 12 / 13
6.6.5 12 / 13
6.6.4 12 / 13
6.6.3 12 / 13
6.6.2 12 / 13
6.6.1 12 / 13
6.6.0 12 / 13
6.5.3 12 / 13
6.5.2 12 / 13
6.5.1 12 / 13
6.5.0 12 / 13
6.4.8 12 / 13
6.4.7 12 / 13
6.4.6 12 / 13
6.4.5 12 / 13
6.4.4 12 / 13
6.4.3 12 / 13
6.4.2 12 / 13
6.4.1 12 / 13
6.4.0 12 / 13
6.3.4 12 / 13
6.3.3 12 / 13
6.3.2 12 / 13
6.3.1 12 / 13
6.3.0 12 / 13
6.2.9 12 / 13
6.2.8 12 / 13
6.2.7 12 / 13
6.2.6 12 / 13
6.2.5 12 / 13
6.2.4 12 / 13
6.2.3 12 / 13
6.2.2 12 / 13
6.2.1 12 / 13
6.2.0 12 / 13
Showing 100 of 221 Next page →

v7.6.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v7.6.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v7.5.10

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.