← Home

@jupyterlab/toc

npm Repository Homepage

JupyterLab - Table of Contents widget

51
Versions
BSD-3-Clause
License
No
Install Scripts
Attested
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation (unverified) npm registry signatures No source commit

Maintainers

darianjasongroutjtpiokrassowskijupyterlab-release-bot

Keywords

jupyterlab

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
publish-pattern new-deps-added AI (publish-pattern): All new deps are canonical JupyterLab/Lumino ecosystem packages. The diff is cross-major-version (5.x vs 6.x), making dependency differences expected and benign for this package. ai
source-diff large-new-source-files AI (source-diff): Cross-major-version diff (5.x vs 6.x) naturally produces large file count differences. Package has SLSA provenance and is published by the official JupyterLab release bot. ai
dependencies unvetted-dep:@jupyter/react-components AI (dependencies): @jupyter/react-components is an official Jupyter project package under the @jupyter scope, consistent with JupyterLab's ecosystem. Not a suspicious dependency. ai
dependencies unvetted-dep:@jupyterlab/markdownviewer AI (dependencies): @jupyterlab/markdownviewer is a first-party JupyterLab package from the same monorepo, published by the same trusted jupyterlab-release-bot. Stable accept for this package. ai
typosquat typosquat.levenshtein:zod AI (typosquat): Clearly not a typosquat; @jupyterlab/toc is a scoped official JupyterLab package with nearly 3000 days of history. ai
typosquat typosquat.levenshtein:got AI (typosquat): Clearly not a typosquat; @jupyterlab/toc is a scoped official JupyterLab package with nearly 3000 days of history. ai
typosquat typosquat.levenshtein:koa AI (typosquat): Clearly not a typosquat; @jupyterlab/toc is a scoped official JupyterLab package with nearly 3000 days of history. ai
bogus-package bogus-package AI (bogus-package): False positive: @jupyterlab/toc has 2828 days of history and 318 versions. Inflated semver and short README signals do not apply to this long-established package. ai
typosquat typosquat.levenshtein:joi AI (typosquat): Clearly not a typosquat; @jupyterlab/toc is a scoped official JupyterLab package with nearly 3000 days of history. ai

Versions (showing 51 of 142)

View all versions
Version Deps Published
6.6.2 15 / 6
6.6.1 15 / 6
6.6.0 15 / 6
6.5.10 15 / 6
6.5.8 15 / 6
6.5.7 15 / 6
6.5.6 15 / 6
6.5.5 15 / 6
6.5.4 15 / 6
6.5.3 15 / 6
6.5.2 15 / 6
6.5.1 15 / 6
6.5.0 15 / 6
6.4.10 15 / 6
6.4.9 15 / 6
6.4.8 15 / 6
6.4.7 15 / 6
6.4.6 15 / 6
6.4.5 15 / 6
6.4.4 15 / 6
6.4.3 15 / 6
6.4.2 15 / 6
6.4.1 15 / 6
6.4.0 15 / 6
6.3.8 15 / 6
6.3.7 15 / 6
6.3.6 15 / 6
6.3.5 15 / 6
6.3.4 15 / 6
6.3.3 15 / 6
6.3.2 15 / 6
6.3.1 15 / 6
6.3.0 15 / 6
6.2.7 14 / 6
6.2.6 14 / 6
6.2.5 14 / 6
6.2.4 14 / 6
6.2.3 14 / 6
6.2.2 14 / 6
6.2.1 14 / 6
6.2.0 14 / 6
6.1.8 14 / 7
6.1.7 14 / 7
6.1.6 14 / 7
6.1.5 14 / 7
6.1.4 14 / 7
6.1.3 14 / 7
6.1.2 14 / 7
6.1.1 14 / 7
6.1.0 14 / 7
6.0.13 14 / 7

v6.6.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.6.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.5.10

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.