@lumino/widgets — Greenflagged

Lumino Widgets

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

blink1073ellisonbgdarianjasongroutjtpiofcollonvalkrassowski

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	large-new-source-files	AI (source-diff): Lumino widgets is a large UI library; version bumps routinely add many source/type/dist files. No install scripts or obfuscation present to weaponize new files.	ai	2026/04/23
maintainer-change	maintainer-added	AI (maintainer-change): Darian (A. Darian) is a listed contributor in package.json; this is a legitimate promotion of an existing project contributor to maintainer status in the JupyterLab/lumino project.	ai	2026/04/23
provenance	publisher-changed	AI (provenance): fcollonval is a well-known JupyterLab ecosystem contributor with 1787 approved packages; transition from jupyterlab-release-bot to a human maintainer account is a legitimate workflow change for this project.	ai	2026/04/23
provenance	missing-githead	AI (provenance): Established JupyterLab ecosystem package with trusted publisher (blink1073, 1765/0 track record). Missing gitHead reflects a publish environment change, not a supply chain risk.	ai	2026/04/23
dependencies	unvetted-dep:@lumino/messaging	AI (dependencies): Sibling package in the jupyterlab/lumino monorepo; same publisher and SLSA-attested supply chain as @lumino/widgets itself.	ai	2026/04/21
dependencies	unvetted-dep:@lumino/commands	AI (dependencies): Sibling package in the jupyterlab/lumino monorepo; same publisher and SLSA-attested supply chain as @lumino/widgets itself.	ai	2026/04/21
dependencies	unvetted-dep:@lumino/virtualdom	AI (dependencies): Sibling package in the jupyterlab/lumino monorepo; same publisher and SLSA-attested supply chain as @lumino/widgets itself.	ai	2026/04/21
dependencies	unvetted-dep:@lumino/disposable	AI (dependencies): Sibling package in the jupyterlab/lumino monorepo; same publisher and SLSA-attested supply chain as @lumino/widgets itself.	ai	2026/04/21
dependencies	unvetted-dep:@lumino/domutils	AI (dependencies): Sibling package in the jupyterlab/lumino monorepo; same publisher and SLSA-attested supply chain as @lumino/widgets itself.	ai	2026/04/21
dependencies	unvetted-dep:@lumino/dragdrop	AI (dependencies): Sibling package in the jupyterlab/lumino monorepo; same publisher and SLSA-attested supply chain as @lumino/widgets itself.	ai	2026/04/21
dependencies	unvetted-dep:@lumino/keyboard	AI (dependencies): Sibling package in the jupyterlab/lumino monorepo; same publisher and SLSA-attested supply chain as @lumino/widgets itself.	ai	2026/04/21

Versions (showing 70 of 70)

Version	Deps	Published
2.7.5	11 / 19	2026-02-05
2.7.4	11 / 19	2026-01-30
2.7.3	11 / 19	2026-01-16
2.7.2	11 / 19	2025-11-13
2.7.1	11 / 19	2025-04-30
2.7.0	11 / 19	2025-03-31
2.6.0	11 / 19	2025-02-01
2.5.0	11 / 19	2024-08-13
2.4.0	11 / 19	2024-06-28
2.3.2	11 / 25	2024-03-25
2.3.1	11 / 25	2023-11-05
2.3.0	11 / 25	2023-07-27
2.2.0	11 / 26	2023-06-23
2.1.1	11 / 26	2023-04-27
2.1.0	11 / 26	2023-04-07
2.0.1	11 / 26	2023-03-27
2.0.0	11 / 26	2023-03-15
1.37.2	11 / 27	2023-03-27
1.37.1	11 / 27	2023-01-23
1.37.0	11 / 27	2023-01-19
1.36.0	11 / 27	2022-12-05
1.35.0	11 / 27	2022-10-31
1.34.1	11 / 27	2022-10-05
1.34.0	11 / 27	2022-08-08
1.33.0	11 / 27	2022-07-06
1.32.1	11 / 27	2022-06-07
1.32.0	11 / 27	2022-05-12
1.31.1	11 / 27	2022-01-13
1.31.0	11 / 27	2022-01-10
1.30.1	11 / 27	2021-12-13
1.30.0	11 / 27	2021-11-04
1.29.0	11 / 27	2021-10-25
1.28.0	11 / 27	2021-09-30
1.27.0	11 / 27	2021-09-22
1.26.2	11 / 27	2021-08-23
1.26.1	11 / 27	2021-08-12
1.26.0	11 / 27	2021-08-03
1.25.0	11 / 27	2021-07-23
1.24.0	11 / 27	2021-07-21
1.23.0	11 / 27	2021-05-10
1.22.0	11 / 27	2021-04-27
1.21.0	11 / 27	2021-04-19
1.20.0	11 / 27	2021-04-09
1.19.1	11 / 27	2021-09-22
1.19.0	11 / 27	2021-03-11
1.18.0	11 / 27	2021-01-19
1.17.0	11 / 27	2020-12-11
1.16.1	11 / 27	2020-12-04
1.16.0	11 / 27	2020-12-01
1.15.0	11 / 27	2020-11-30
1.14.1	11 / 27	2020-11-02
1.14.0	11 / 27	2020-08-20
1.13.4	11 / 27	2020-07-27
1.13.3	11 / 27	2020-07-21
1.13.2	11 / 27	2020-06-26
1.13.1	11 / 27	2020-06-25
1.13.0	11 / 26	2020-05-23
1.12.2	11 / 20	2020-05-12
1.12.1	11 / 20	2020-05-07
1.12.0	11 / 20	2020-04-24
1.11.1	11 / 20	2020-02-19
1.11.0	11 / 20	2020-02-10
1.10.2	11 / 20	2020-01-27
1.10.1	11 / 20	2020-01-24
1.10.0	11 / 20	2020-01-08
1.9.7	11 / 20	2020-01-02
1.9.6	11 / 20	2019-12-19
1.9.5	11 / 20	2019-12-17
1.9.4	11 / 19	2019-12-09
1.9.3	11 / 18	2019-11-17

v2.7.5

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.7.4

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.7.3

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.7.2

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.7.1

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.7.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.6.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.5.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.4.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.3.2

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.3.1

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.3.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v2.2.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v2.1.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.37.2

3 findings

HIGH Publisher changed: jupyterlab-release-bot → fcollonval (on 2023-03-27) provenance

This version was published by a different npm account than previous versions on 2023-03-27. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Missing gitHead — previous versions had it provenance

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: fcollonval.

v1.37.1

3 findings

HIGH Publisher changed: blink1073 → fcollonval (on 2023-01-23) provenance

This version was published by a different npm account than previous versions on 2023-01-23. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Missing gitHead — previous versions had it provenance

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: fcollonval.

v1.37.0

3 findings

HIGH Publisher changed: blink1073 → fcollonval (on 2023-01-19) provenance

This version was published by a different npm account than previous versions on 2023-01-19. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Missing gitHead — previous versions had it provenance

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: fcollonval.

v1.36.0

3 findings

HIGH Publisher changed: blink1073 → fcollonval (on 2022-12-05) provenance

This version was published by a different npm account than previous versions on 2022-12-05. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Missing gitHead — previous versions had it provenance

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: fcollonval.

v1.35.0

3 findings

HIGH Publisher changed: blink1073 → fcollonval (on 2022-10-31) provenance

This version was published by a different npm account than previous versions on 2022-10-31. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Missing gitHead — previous versions had it provenance

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: fcollonval.

v1.34.1

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: fcollonval.

HIGH Publisher changed: blink1073 → fcollonval (on 2022-10-05) provenance

This version was published by a different npm account than previous versions on 2022-10-05. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.34.0

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: fcollonval.

HIGH Publisher changed: blink1073 → fcollonval (on 2022-08-08) provenance

This version was published by a different npm account than previous versions on 2022-08-08. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.33.0

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: fcollonval.

HIGH Publisher changed: blink1073 → fcollonval (on 2022-07-06) provenance

This version was published by a different npm account than previous versions on 2022-07-06. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.32.1

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: blink1073.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.32.0

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: blink1073.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.31.1

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: blink1073.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.31.0

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: blink1073.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.30.1

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: blink1073.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.30.0

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: jasongrout.

HIGH Publisher changed: blink1073 → jasongrout (on 2021-11-04) provenance

This version was published by a different npm account than previous versions on 2021-11-04. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.29.0

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: blink1073.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.28.0

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: blink1073.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.27.0

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: blink1073.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.26.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.26.1

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: blink1073.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.26.0

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: blink1073.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.25.0

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: blink1073.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.24.0

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: blink1073.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.23.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.22.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.21.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.20.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.19.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.19.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.18.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.17.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.16.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.16.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.15.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.14.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.14.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.13.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.13.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.13.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.13.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.13.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.12.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.12.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.12.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.11.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.11.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.10.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.10.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.10.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.9.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.9.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.9.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.9.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.9.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.