@serenity-js/core
The core Serenity/JS framework, providing the Screenplay Pattern interfaces, as well as the test reporting and integration infrastructure
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:dynamic-require | AI (semgrep): ModuleLoader is a documented plugin/module loading mechanism; dynamic require is intentional and stable across versions. | ai | |
| dependencies | unvetted-dep:tiny-types | AI (dependencies): tiny-types is a companion library in the serenity-js ecosystem, pinned to exact version. | ai | |
| typosquat | typosquat.levenshtein:cors | AI (typosquat): @serenity-js/core is a long-established scoped package; Levenshtein match to 'cors' is a false positive. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Base64 decode is used for JSON artifact deserialization (JSONData model), not obfuscation. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Reflect.get is used in a Proxy handler for Screenplay Pattern question chaining — legitimate pattern. | ai |
Versions (showing 19 of 119)
| Version | Deps | Published |
|---|---|---|
| 3.7.0 | 12 / 13 | |
| 3.6.1 | 12 / 13 | |
| 3.6.0 | 12 / 13 | |
| 3.5.0 | 12 / 13 | |
| 3.4.2 | 12 / 13 | |
| 3.4.1 | 12 / 13 | |
| 3.4.0 | 12 / 13 | |
| 3.3.1 | 12 / 13 | |
| 3.3.0 | 12 / 13 | |
| 3.2.1 | 12 / 13 | |
| 3.2.0 | 12 / 13 | |
| 3.1.6 | 12 / 13 | |
| 3.1.5 | 12 / 13 | |
| 3.1.3 | 12 / 13 | |
| 3.1.2 | 12 / 13 | |
| 3.1.1 | 12 / 13 | |
| 3.1.0 | 12 / 13 | |
| 3.0.1 | 12 / 14 | |
| 3.0.0 | 12 / 14 |
v3.7.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.6.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.6.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.5.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.4.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.4.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.4.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.3.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.3.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.2.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.2.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.1.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.1.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.1.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.1.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.1.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.1.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.