@nuxt/rspack-builder
rspack bundler for Nuxt
31
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
nuxtbot
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:raw-loader | AI (phantom-deps): Webpack/rspack loader referenced by config string, not static import. | ai | |
| phantom-deps | phantom-dep:mini-css-extract-plugin | AI (phantom-deps): Build-tool plugin referenced by config, not static import. | ai | |
| publish-pattern | rapid-publish | AI (publish-pattern): Monorepo lockstep release across many @nuxt packages; not anomalous. | ai | |
| provenance | publisher-changed | AI (provenance): Nuxt monorepo publishes via GitHub Actions CI/CD with SLSA attestation; this is the expected publisher going forward. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Nuxt team consolidated publishing to GitHub Actions; maintainer list change is intentional org-level transition. | ai | |
| source-diff | obfuscated-file:dist/_chunks/libs/@vue/compiler-core.d.mts | AI (source-diff): TypeScript declaration file with long type union lines; not obfuscated code. | ai | |
| source-diff | large-new-source-files | AI (source-diff): New files are type declaration bundles for known upstream packages. | ai | |
| source-diff | net-exec-file:dist/_chunks/libs/@vue/compiler-core.d.mts | AI (source-diff): False positive on a .d.mts type declaration file; no runtime network or exec calls. | ai | |
| source-diff | obfuscated-file:dist/_chunks/libs/@vue/compiler-dom.d.mts | AI (source-diff): TypeScript declaration file with long re-export lines; not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/_chunks/libs/@babel/parser.d.mts | AI (source-diff): TypeScript declaration file for @babel/types; long union type lines are expected. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase is from bundled type declarations for Vue/Babel deps, not injected payloads. | ai | |
| phantom-deps | phantom-dep:cssnano | AI (phantom-deps): Rspack builder passes loaders/plugins to user config; declared deps not directly imported is expected pattern. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Nuxt monorepo package; README link density is from framework docs, not a link farm. | ai | |
| phantom-deps | phantom-dep:postcss | AI (phantom-deps): Same pattern: build-tool deps passed through to rspack config, not directly imported. | ai | |
| phantom-deps | phantom-dep:css-loader | AI (phantom-deps): Webpack/rspack loader dep passed through config, not directly imported. | ai | |
| phantom-deps | phantom-dep:tinyglobby | AI (phantom-deps): Utility dep used indirectly via config; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:url-loader | AI (phantom-deps): Rspack loader dep passed through config, not directly imported. | ai | |
| phantom-deps | phantom-dep:file-loader | AI (phantom-deps): Rspack loader dep passed through config, not directly imported. | ai | |
| phantom-deps | phantom-dep:postcss-url | AI (phantom-deps): PostCSS plugin dep passed through config, not directly imported. | ai | |
| phantom-deps | phantom-dep:autoprefixer | AI (phantom-deps): PostCSS plugin dep passed through config, not directly imported. | ai | |
| phantom-deps | phantom-dep:postcss-import | AI (phantom-deps): PostCSS plugin dep passed through config, not directly imported. | ai | |
| phantom-deps | phantom-dep:postcss-loader | AI (phantom-deps): Rspack loader dep passed through config, not directly imported. | ai | |
| phantom-deps | phantom-dep:pug-plain-loader | AI (phantom-deps): Rspack loader dep passed through config, not directly imported. | ai |
Versions (showing 31 of 31)
| Version | Deps | Published |
|---|---|---|
| 4.5.0 | 41 / 7 | |
| 4.4.8 | 41 / 8 | |
| 4.4.7 | 41 / 8 | |
| 4.4.6 | 41 / 8 | |
| 4.4.5 | 41 / 8 | |
| 4.4.4 | 41 / 8 | |
| 4.4.2 | 42 / 8 | |
| 4.3.1 | 42 / 8 | |
| 4.3.0 | 42 / 8 | |
| 4.2.2 | 40 / 6 | |
| 4.2.1 | 40 / 6 | |
| 4.2.0 | 40 / 6 | |
| 4.1.3 | 39 / 6 | |
| 4.1.2 | 39 / 6 | |
| 4.1.1 | 39 / 6 | |
| 4.1.0 | 39 / 6 | |
| 4.0.3 | 39 / 6 | |
| 4.0.2 | 39 / 6 | |
| 4.0.1 | 39 / 6 | |
| 4.0.0 | 39 / 6 | |
| 3.21.9 | 40 / 9 | |
| 3.21.8 | 40 / 9 | |
| 3.21.7 | 40 / 9 | |
| 3.21.6 | 40 / 9 | |
| 3.21.5 | 40 / 9 | |
| 3.21.4 | 40 / 9 | |
| 3.21.2 | 41 / 9 | |
| 3.21.1 | 41 / 9 | |
| 3.21.0 | 41 / 9 | |
| 3.20.2 | 39 / 7 | |
| 3.20.1 | 39 / 7 |
v4.5.0
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.21.9
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.21.8
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.