@kie-tools/runtime-tools-management-console-webapp

<!-- Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to

Supply chain provenance

Status for the latest visible version.

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
install-scripts	install-script:install	AI (install-scripts): node install.js is a standard build-tool setup script for this Apache KIE Tools monorepo package.	ai	2026/04/29
semgrep	semgrep:child-process-import	AI (semgrep): child_process used in webpack.config.js at build time only; not a runtime risk for this build-tool package.	ai	2026/04/29
phantom-deps	phantom-dep:axios	AI (phantom-deps): Declared runtime dep used indirectly via config; stable false positive for this webapp package.	ai	2026/04/29
phantom-deps	phantom-dep:graphql	AI (phantom-deps): Declared runtime dep used indirectly via codegen config; stable false positive.	ai	2026/04/29
phantom-deps	phantom-dep:react-apollo-hooks	AI (phantom-deps): Declared runtime dep used indirectly; stable false positive for this webapp.	ai	2026/04/29
phantom-deps	phantom-dep:apollo-link-context	AI (phantom-deps): Declared runtime dep used indirectly; stable false positive for this webapp.	ai	2026/04/29
phantom-deps	phantom-dep:@kie-tools/runtime-tools-shared-webapp-components	AI (phantom-deps): Same-org sibling dep; phantom-dep heuristic is unreliable for monorepo packages.	ai	2026/04/29
bogus-package	bogus-package	AI (bogus-package): README link dump is typical for Apache KIE Tools monorepo packages pointing to project docs; not spam.	ai	2026/04/29

Version	Deps	Published
10.2.0	26 / 56	2026-04-26