@jupyterlab/services
Client APIs for the Jupyter services REST APIs
21
Versions
BSD-3-Clause
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
darianjasongroutjtpiokrassowskijupyterlab-release-bot
Keywords
jupyternotebookservices
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:ws | AI (phantom-deps): ws is a legitimate runtime dependency used for WebSocket support; phantom-dep fires due to dynamic/conditional import patterns in this isomorphic library. | ai | |
| phantom-deps | phantom-dep:node-fetch | AI (phantom-deps): node-fetch is loaded via eval('require')('node-fetch') to avoid bundler inclusion; static analysis cannot detect this dynamic import. Legitimate runtime dependency. | ai | |
| semgrep | semgrep:eval-usage | AI (semgrep): eval('require') is a hardcoded static string used to conditionally load node-fetch in Node.js environments without bundler interference — a well-known legitimate isomorphic pattern with no dynamic input. | ai | |
| phantom-deps | phantom-dep:@types/text-encoding | AI (phantom-deps): Type-only package used for TypeScript compilation; not directly imported at runtime is expected behavior for @types packages. | ai | |
| provenance | no-provenance | AI (provenance): This is a legacy version predating npm provenance attestation; absence is expected and not a risk signal for this well-established package. | ai | |
| dependencies | unvetted-dep:@types/text-encoding | AI (dependencies): @types/text-encoding is a TypeScript type definition package with no runtime code; it poses no security risk for this package. | ai | |
| phantom-deps | phantom-dep:@types/minimist | AI (phantom-deps): @types/minimist as a runtime dep is a harmless quirk of older TypeScript project conventions; no security implication. | ai | |
| dependencies | unvetted-dep:phosphor | AI (dependencies): phosphor was the official predecessor UI framework for JupyterLab; its use in early @jupyterlab/services versions is expected and legitimate. | ai | |
| provenance | publisher-changed | AI (provenance): Migration from jupyterlab-release-bot to GitHub Actions OIDC publishing with SLSA provenance; legitimate CI/CD infrastructure change for the JupyterLab project. | ai | |
| dependencies | unvetted-dep:@jupyterlab/coreutils | AI (dependencies): Known JupyterLab sibling package; expected dependency for @jupyterlab/services. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Inflated semver is expected for JupyterLab monorepo packages published at their monorepo version. README signal is a false positive for this legitimate Project Jupyter package. | ai | |
| dependencies | unvetted-dep:@jupyterlab/settingregistry | AI (dependencies): Known JupyterLab sibling package; expected dependency for @jupyterlab/services. | ai | |
| dependencies | unvetted-dep:@jupyter/ydoc | AI (dependencies): Known JupyterLab ecosystem dependency; expected transitive dep for this package. | ai | |
| dependencies | unvetted-dep:@lumino/polling | AI (dependencies): Known Lumino ecosystem dependency; expected for @jupyterlab/services. | ai | |
| dependencies | unvetted-dep:@lumino/coreutils | AI (dependencies): Known Lumino ecosystem dependency; expected for @jupyterlab/services. | ai | |
| dependencies | unvetted-dep:@lumino/signaling | AI (dependencies): Known Lumino ecosystem dependency; expected for @jupyterlab/services. | ai | |
| dependencies | unvetted-dep:@lumino/disposable | AI (dependencies): Known Lumino ecosystem dependency; expected for @jupyterlab/services. | ai | |
| dependencies | unvetted-dep:@lumino/properties | AI (dependencies): Known Lumino ecosystem dependency; expected for @jupyterlab/services. | ai | |
| dependencies | unvetted-dep:@jupyterlab/statedb | AI (dependencies): Known JupyterLab sibling package; expected dependency for @jupyterlab/services. | ai | |
| dependencies | unvetted-dep:@jupyterlab/nbformat | AI (dependencies): Known JupyterLab sibling package; expected dependency for @jupyterlab/services. | ai |
Versions (showing 21 of 221)
| Version | Deps | Published |
|---|---|---|
| 0.35.1 | 6 / 15 | |
| 0.35.0 | 6 / 15 | |
| 0.34.3 | 6 / 15 | |
| 0.34.2 | 6 / 15 | |
| 0.34.1 | 6 / 15 | |
| 0.34.0 | 6 / 15 | |
| 0.33.1 | 6 / 15 | |
| 0.33.0 | 6 / 15 | |
| 0.32.0 | 6 / 15 | |
| 0.31.0 | 6 / 15 | |
| 0.30.2 | 6 / 15 | |
| 0.30.1 | 6 / 15 | |
| 0.30.0 | 6 / 15 | |
| 0.29.0 | 6 / 15 | |
| 0.28.0 | 6 / 15 | |
| 0.27.0 | 6 / 15 | |
| 0.26.0 | 6 / 15 | |
| 0.25.0 | 6 / 15 | |
| 0.24.0 | 6 / 15 | |
| 0.23.0 | 6 / 15 | |
| 0.22.0 | 7 / 15 |