@shopify/create-app
A CLI tool to create a new Shopify app.
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | net-exec-file:dist/chunk-DNF3EUMN.js | AI (source-diff): Bundled third-party deps in esbuild output; standard pattern for @shopify/create-app. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Major version bump with full rebundle; expected for @shopify/create-app release cadence. | ai | |
| source-diff | net-exec-file:dist/chunk-YUPQUA3D.js | AI (source-diff): Bundled third-party deps in esbuild output; standard pattern for @shopify/create-app. | ai | |
| source-diff | net-exec-file:dist/chunk-UX6FRPFM.js | AI (source-diff): Bundled third-party deps in esbuild output; standard pattern for @shopify/create-app. | ai | |
| source-diff | net-exec-file:dist/chunk-STHW3YIX.js | AI (source-diff): Bundled third-party deps in esbuild output; standard pattern for @shopify/create-app. | ai | |
| source-diff | net-exec-file:dist/chunk-LNOZTAML.js | AI (source-diff): Bundled third-party deps in esbuild output; standard pattern for @shopify/create-app. | ai | |
| source-diff | net-exec-file:dist/chunk-27ZXSSGX.js | AI (source-diff): Standard esbuild bundle of legitimate npm deps; readable source paths confirm no obfuscation. | ai | |
| source-diff | net-exec-file:dist/chunk-QCVAV5PM.js | AI (source-diff): Standard esbuild bundle of legitimate npm deps; readable source paths confirm no obfuscation. | ai | |
| source-diff | net-exec-file:dist/chunk-XDAJMLCV.js | AI (source-diff): Standard esbuild bundle of legitimate npm deps; readable source paths confirm no obfuscation. | ai | |
| source-diff | net-exec-file:dist/chunk-GUVQJPFV.js | AI (source-diff): Standard esbuild bundle of legitimate npm deps; readable code, no obfuscation, SLSA-attested CI publish. | ai | |
| source-diff | net-exec-file:dist/chunk-77I3TRE2.js | AI (source-diff): Standard esbuild bundle of legitimate npm deps; readable code, no obfuscation, SLSA-attested CI publish. | ai | |
| source-diff | net-exec-file:dist/chunk-4IXPA7MG.js | AI (source-diff): Standard esbuild bundle of legitimate npm deps; readable code, no obfuscation, SLSA-attested CI publish. | ai | |
| source-diff | net-exec-file:dist/chunk-V6HCEO5N.js | AI (source-diff): Standard esbuild bundle of legitimate npm deps; readable, non-obfuscated code from known packages. | ai | |
| source-diff | net-exec-file:dist/chunk-IFG7N3S2.js | AI (source-diff): Standard esbuild bundle of legitimate npm deps; readable, non-obfuscated code from known packages. | ai | |
| source-diff | net-exec-file:dist/chunk-3QXHJGOG.js | AI (source-diff): Standard esbuild bundle of legitimate npm deps; readable, non-obfuscated code from known packages. | ai | |
| phantom-deps | phantom-dep:esbuild | AI (phantom-deps): esbuild is a declared runtime dependency used as a bundler binary; phantom-dep heuristic is a stable false positive here. | ai | |
| source-diff | net-exec-file:dist/chunk-X7WPZPGY.js | AI (source-diff): Standard esbuild bundle of legitimate npm deps; readable, non-obfuscated code from known packages. | ai |
Versions (showing 51 of 136)
| Version | Deps | Published |
|---|---|---|
| 4.0.0 | 1 / 4 | |
| 3.94.3 | 1 / 4 | |
| 3.94.2 | 1 / 4 | |
| 3.94.1 | 1 / 4 | |
| 3.94.0 | 1 / 4 | |
| 3.93.2 | 1 / 4 | |
| 3.93.1 | 1 / 4 | |
| 3.93.0 | 1 / 4 | |
| 3.58.2 | 2 / 3 | |
| 3.58.1 | 2 / 3 | |
| 3.58.0 | 2 / 3 | |
| 3.57.1 | 2 / 3 | |
| 3.57.0 | 2 / 3 | |
| 3.56.3 | 2 / 3 | |
| 3.56.2 | 2 / 3 | |
| 3.56.1 | 2 / 3 | |
| 3.56.0 | 2 / 3 | |
| 3.55.4 | 2 / 3 | |
| 3.55.3 | 2 / 3 | |
| 3.55.2 | 2 / 3 | |
| 3.55.1 | 2 / 3 | |
| 3.55.0 | 2 / 3 | |
| 3.54.0 | 2 / 3 | |
| 3.53.1 | 2 / 3 | |
| 3.53.0 | 2 / 3 | |
| 3.52.0 | 2 / 3 | |
| 3.51.2 | 2 / 3 | |
| 3.51.1 | 2 / 3 | |
| 3.51.0 | 2 / 3 | |
| 3.50.2 | 2 / 3 | |
| 3.50.1 | 2 / 3 | |
| 3.50.0 | 2 / 3 | |
| 3.49.7 | 2 / 3 | |
| 3.49.6 | 2 / 3 | |
| 3.49.5 | 2 / 3 | |
| 3.49.4 | 2 / 3 | |
| 3.49.3 | 2 / 3 | |
| 3.49.2 | 2 / 3 | |
| 3.49.1 | 2 / 3 | |
| 3.49.0 | 2 / 3 | |
| 3.48.6 | 2 / 3 | |
| 3.48.5 | 2 / 3 | |
| 3.48.4 | 2 / 3 | |
| 3.48.3 | 2 / 3 | |
| 3.48.2 | 2 / 3 | |
| 3.48.1 | 2 / 3 | |
| 3.48.0 | 2 / 3 | |
| 3.47.5 | 2 / 3 | |
| 3.47.4 | 2 / 3 | |
| 3.47.3 | 2 / 3 | |
| 3.47.2 | 2 / 3 |
v3.58.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.58.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.58.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.57.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.57.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.56.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.56.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.56.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.56.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.55.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.55.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.55.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.55.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.55.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.54.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.53.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.53.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.52.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.51.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.51.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.51.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.50.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.50.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.50.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.49.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.49.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.49.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.49.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.49.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.49.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.49.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.49.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.48.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.48.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.48.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.48.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.48.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.48.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.48.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.47.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.47.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.47.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.47.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.