← Home

@lumino/widgets

npm Repository Homepage

Lumino Widgets

51
Versions
BSD-3-Clause
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

blink1073ellisonbgdarianjasongroutjtpiofcollonvalkrassowski

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff large-new-source-files AI (source-diff): Lumino widgets is a large UI library; version bumps routinely add many source/type/dist files. No install scripts or obfuscation present to weaponize new files. ai
maintainer-change maintainer-added AI (maintainer-change): Darian (A. Darian) is a listed contributor in package.json; this is a legitimate promotion of an existing project contributor to maintainer status in the JupyterLab/lumino project. ai
provenance publisher-changed AI (provenance): fcollonval is a well-known JupyterLab ecosystem contributor with 1787 approved packages; transition from jupyterlab-release-bot to a human maintainer account is a legitimate workflow change for this project. ai
provenance missing-githead AI (provenance): Established JupyterLab ecosystem package with trusted publisher (blink1073, 1765/0 track record). Missing gitHead reflects a publish environment change, not a supply chain risk. ai
dependencies unvetted-dep:@lumino/messaging AI (dependencies): Sibling package in the jupyterlab/lumino monorepo; same publisher and SLSA-attested supply chain as @lumino/widgets itself. ai
dependencies unvetted-dep:@lumino/commands AI (dependencies): Sibling package in the jupyterlab/lumino monorepo; same publisher and SLSA-attested supply chain as @lumino/widgets itself. ai
dependencies unvetted-dep:@lumino/virtualdom AI (dependencies): Sibling package in the jupyterlab/lumino monorepo; same publisher and SLSA-attested supply chain as @lumino/widgets itself. ai
dependencies unvetted-dep:@lumino/disposable AI (dependencies): Sibling package in the jupyterlab/lumino monorepo; same publisher and SLSA-attested supply chain as @lumino/widgets itself. ai
dependencies unvetted-dep:@lumino/domutils AI (dependencies): Sibling package in the jupyterlab/lumino monorepo; same publisher and SLSA-attested supply chain as @lumino/widgets itself. ai
dependencies unvetted-dep:@lumino/dragdrop AI (dependencies): Sibling package in the jupyterlab/lumino monorepo; same publisher and SLSA-attested supply chain as @lumino/widgets itself. ai
dependencies unvetted-dep:@lumino/keyboard AI (dependencies): Sibling package in the jupyterlab/lumino monorepo; same publisher and SLSA-attested supply chain as @lumino/widgets itself. ai

Versions (showing 51 of 72)

View all versions
Version Deps Published
2.9.0 11 / 19
2.8.0 11 / 19
2.7.5 11 / 19
2.7.4 11 / 19
2.7.3 11 / 19
2.7.2 11 / 19
2.7.1 11 / 19
2.7.0 11 / 19
2.6.0 11 / 19
2.5.0 11 / 19
2.4.0 11 / 19
2.3.2 11 / 25
2.3.1 11 / 25
2.3.0 11 / 25
2.2.0 11 / 26
2.1.1 11 / 26
2.1.0 11 / 26
2.0.1 11 / 26
2.0.0 11 / 26
1.37.2 11 / 27
1.37.1 11 / 27
1.37.0 11 / 27
1.36.0 11 / 27
1.35.0 11 / 27
1.34.1 11 / 27
1.34.0 11 / 27
1.33.0 11 / 27
1.32.1 11 / 27
1.32.0 11 / 27
1.31.1 11 / 27
1.31.0 11 / 27
1.30.1 11 / 27
1.30.0 11 / 27
1.29.0 11 / 27
1.28.0 11 / 27
1.27.0 11 / 27
1.26.2 11 / 27
1.26.1 11 / 27
1.26.0 11 / 27
1.25.0 11 / 27
1.24.0 11 / 27
1.23.0 11 / 27
1.22.0 11 / 27
1.21.0 11 / 27
1.20.0 11 / 27
1.19.1 11 / 27
1.19.0 11 / 27
1.18.0 11 / 27
1.17.0 11 / 27
1.16.1 11 / 27
1.16.0 11 / 27

v2.9.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.