@lofcz/platejs-code-drawing

Code drawing plugin for Plate (PlantUml, Graphviz, Flowchart, Mermaid)

Supply chain provenance

Status for the latest visible version.

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

Keywords

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
bogus-package	bogus-package	AI (bogus-package): Inflated semver mirrors upstream plate v52.x fork; not spam, just a scoped fork package.	ai	2026/05/15
dependencies	unvetted-dep:flowchart.js	AI (dependencies): flowchart.js is a well-known diagramming library; appropriate for a code-drawing plugin.	ai	2026/05/15
dependencies	unvetted-dep:plantuml-encoder	AI (dependencies): plantuml-encoder is a standard utility for PlantUML; appropriate for this plugin's stated purpose.	ai	2026/05/15
phantom-deps	phantom-dep:react-compiler-runtime	AI (phantom-deps): Declared runtime dep; phantom-dep heuristic false positive for this plugin package.	ai	2026/05/01
phantom-deps	phantom-dep:lodash	AI (phantom-deps): Monorepo plugin; lodash declared as dep and used transitively/in config, not a phantom risk.	ai	2026/05/01
phantom-deps	phantom-dep:@codemirror/lang-javascript	AI (phantom-deps): Declared runtime dep; phantom-dep heuristic false positive for this plugin package.	ai	2026/05/01
phantom-deps	phantom-dep:@codemirror/theme-one-dark	AI (phantom-deps): Declared runtime dep; phantom-dep heuristic false positive for this plugin package.	ai	2026/05/01
phantom-deps	phantom-dep:@platejs/utils	AI (phantom-deps): Aliased dep (@lofcz/platejs-utils); phantom-dep heuristic misfires on npm aliases.	ai	2026/05/01
phantom-deps	phantom-dep:@uiw/react-codemirror	AI (phantom-deps): Declared runtime dep; phantom-dep heuristic false positive for this plugin package.	ai	2026/05/01

Version	Deps	Published
53.0.0	10 / 5	2026-04-28
52.3.6	10 / 5	2026-04-05
52.3.0	10 / 4	2026-03-21