@nuxt/webpack-builder
Webpack bundler for Nuxt
31
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
nuxtbot
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Nuxt monorepo publishes via GitHub Actions CI with SLSA attestation; this is the expected publisher going forward. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Maintainer list change reflects CI-based publishing model for the Nuxt monorepo, not a takeover. | ai | |
| source-diff | obfuscated-file:dist/_chunks/libs/@vue/compiler-dom.d.mts | AI (source-diff): Auto-generated TypeScript declaration rollup; long lines are expected in bundled .d.mts files. | ai | |
| source-diff | obfuscated-file:dist/_chunks/libs/@babel/parser.d.mts | AI (source-diff): Auto-generated TypeScript declaration rollup; long lines are expected in bundled .d.mts files. | ai | |
| source-diff | obfuscated-file:dist/_chunks/libs/@vue/compiler-core.d.mts | AI (source-diff): Auto-generated TypeScript declaration rollup; long lines are expected in bundled .d.mts files. | ai | |
| source-diff | large-new-source-files | AI (source-diff): New files are type declaration rollups from dependency version bump, not injected code. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase explained by bundled type declaration files from @vue/compiler-sfc 3.5.27 upgrade. | ai | |
| source-diff | net-exec-file:dist/_chunks/libs/@vue/compiler-core.d.mts | AI (source-diff): Declaration file only; no runtime network or exec calls — false positive from type-level imports. | ai | |
| phantom-deps | phantom-dep:postcss-import | AI (phantom-deps): PostCSS plugin referenced via config, not direct import. | ai | |
| phantom-deps | phantom-dep:postcss-loader | AI (phantom-deps): Webpack loader referenced via config string, not direct import. | ai | |
| phantom-deps | phantom-dep:cssnano | AI (phantom-deps): Webpack builder; loaders/plugins referenced via config strings, not direct imports. Stable FP for this package. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Auto-generated monorepo package; README and metadata patterns are typical for Nuxt sub-packages. | ai | |
| phantom-deps | phantom-dep:pug-plain-loader | AI (phantom-deps): Webpack loader referenced via config string, not direct import. | ai | |
| phantom-deps | phantom-dep:postcss | AI (phantom-deps): Same pattern — config-referenced dependency, not directly imported. | ai | |
| phantom-deps | phantom-dep:css-loader | AI (phantom-deps): Webpack loader referenced via config string, not direct import. | ai | |
| phantom-deps | phantom-dep:tinyglobby | AI (phantom-deps): Utility dep used indirectly; stable FP for this webpack builder package. | ai | |
| phantom-deps | phantom-dep:url-loader | AI (phantom-deps): Webpack loader referenced via config string, not direct import. | ai | |
| phantom-deps | phantom-dep:file-loader | AI (phantom-deps): Webpack loader referenced via config string, not direct import. | ai | |
| phantom-deps | phantom-dep:postcss-url | AI (phantom-deps): PostCSS plugin referenced via config, not direct import. | ai | |
| phantom-deps | phantom-dep:autoprefixer | AI (phantom-deps): PostCSS plugin referenced via config, not direct import. | ai |
Versions (showing 31 of 31)
| Version | Deps | Published |
|---|---|---|
| 4.5.0 | 44 / 9 | |
| 4.4.8 | 42 / 9 | |
| 4.4.7 | 42 / 9 | |
| 4.4.6 | 42 / 9 | |
| 4.4.5 | 42 / 9 | |
| 4.4.4 | 42 / 9 | |
| 4.4.2 | 43 / 9 | |
| 4.3.1 | 43 / 9 | |
| 4.3.0 | 43 / 9 | |
| 4.2.2 | 41 / 7 | |
| 4.2.1 | 41 / 7 | |
| 4.2.0 | 41 / 7 | |
| 4.1.3 | 40 / 7 | |
| 4.1.2 | 40 / 7 | |
| 4.1.1 | 40 / 7 | |
| 4.1.0 | 40 / 7 | |
| 4.0.3 | 40 / 7 | |
| 4.0.2 | 40 / 7 | |
| 4.0.1 | 40 / 7 | |
| 4.0.0 | 40 / 7 | |
| 3.21.9 | 41 / 10 | |
| 3.21.8 | 41 / 10 | |
| 3.21.7 | 41 / 10 | |
| 3.21.6 | 41 / 10 | |
| 3.21.5 | 41 / 10 | |
| 3.21.4 | 41 / 10 | |
| 3.21.2 | 42 / 10 | |
| 3.21.1 | 42 / 10 | |
| 3.21.0 | 42 / 10 | |
| 3.20.2 | 40 / 8 | |
| 3.20.1 | 40 / 8 |
v4.5.0
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.21.9
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.21.8
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.