@shopify/create-app
A CLI tool to create a new Shopify app.
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | net-exec-file:dist/chunk-DNF3EUMN.js | AI (source-diff): Bundled third-party deps in esbuild output; standard pattern for @shopify/create-app. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Major version bump with full rebundle; expected for @shopify/create-app release cadence. | ai | |
| source-diff | net-exec-file:dist/chunk-YUPQUA3D.js | AI (source-diff): Bundled third-party deps in esbuild output; standard pattern for @shopify/create-app. | ai | |
| source-diff | net-exec-file:dist/chunk-UX6FRPFM.js | AI (source-diff): Bundled third-party deps in esbuild output; standard pattern for @shopify/create-app. | ai | |
| source-diff | net-exec-file:dist/chunk-STHW3YIX.js | AI (source-diff): Bundled third-party deps in esbuild output; standard pattern for @shopify/create-app. | ai | |
| source-diff | net-exec-file:dist/chunk-LNOZTAML.js | AI (source-diff): Bundled third-party deps in esbuild output; standard pattern for @shopify/create-app. | ai | |
| source-diff | net-exec-file:dist/chunk-27ZXSSGX.js | AI (source-diff): Standard esbuild bundle of legitimate npm deps; readable source paths confirm no obfuscation. | ai | |
| source-diff | net-exec-file:dist/chunk-QCVAV5PM.js | AI (source-diff): Standard esbuild bundle of legitimate npm deps; readable source paths confirm no obfuscation. | ai | |
| source-diff | net-exec-file:dist/chunk-XDAJMLCV.js | AI (source-diff): Standard esbuild bundle of legitimate npm deps; readable source paths confirm no obfuscation. | ai | |
| source-diff | net-exec-file:dist/chunk-GUVQJPFV.js | AI (source-diff): Standard esbuild bundle of legitimate npm deps; readable code, no obfuscation, SLSA-attested CI publish. | ai | |
| source-diff | net-exec-file:dist/chunk-77I3TRE2.js | AI (source-diff): Standard esbuild bundle of legitimate npm deps; readable code, no obfuscation, SLSA-attested CI publish. | ai | |
| source-diff | net-exec-file:dist/chunk-4IXPA7MG.js | AI (source-diff): Standard esbuild bundle of legitimate npm deps; readable code, no obfuscation, SLSA-attested CI publish. | ai | |
| source-diff | net-exec-file:dist/chunk-V6HCEO5N.js | AI (source-diff): Standard esbuild bundle of legitimate npm deps; readable, non-obfuscated code from known packages. | ai | |
| source-diff | net-exec-file:dist/chunk-IFG7N3S2.js | AI (source-diff): Standard esbuild bundle of legitimate npm deps; readable, non-obfuscated code from known packages. | ai | |
| source-diff | net-exec-file:dist/chunk-3QXHJGOG.js | AI (source-diff): Standard esbuild bundle of legitimate npm deps; readable, non-obfuscated code from known packages. | ai | |
| phantom-deps | phantom-dep:esbuild | AI (phantom-deps): esbuild is a declared runtime dependency used as a bundler binary; phantom-dep heuristic is a stable false positive here. | ai | |
| source-diff | net-exec-file:dist/chunk-X7WPZPGY.js | AI (source-diff): Standard esbuild bundle of legitimate npm deps; readable, non-obfuscated code from known packages. | ai |
Versions (showing 100 of 136)
| Version | Deps | Published |
|---|---|---|
| 4.0.0 | 1 / 4 | |
| 3.94.3 | 1 / 4 | |
| 3.94.2 | 1 / 4 | |
| 3.94.1 | 1 / 4 | |
| 3.94.0 | 1 / 4 | |
| 3.93.2 | 1 / 4 | |
| 3.93.1 | 1 / 4 | |
| 3.93.0 | 1 / 4 | |
| 3.58.2 | 2 / 3 | |
| 3.58.1 | 2 / 3 | |
| 3.58.0 | 2 / 3 | |
| 3.57.1 | 2 / 3 | |
| 3.57.0 | 2 / 3 | |
| 3.56.3 | 2 / 3 | |
| 3.56.2 | 2 / 3 | |
| 3.56.1 | 2 / 3 | |
| 3.56.0 | 2 / 3 | |
| 3.55.4 | 2 / 3 | |
| 3.55.3 | 2 / 3 | |
| 3.55.2 | 2 / 3 | |
| 3.55.1 | 2 / 3 | |
| 3.55.0 | 2 / 3 | |
| 3.54.0 | 2 / 3 | |
| 3.53.1 | 2 / 3 | |
| 3.53.0 | 2 / 3 | |
| 3.52.0 | 2 / 3 | |
| 3.51.2 | 2 / 3 | |
| 3.51.1 | 2 / 3 | |
| 3.51.0 | 2 / 3 | |
| 3.50.2 | 2 / 3 | |
| 3.50.1 | 2 / 3 | |
| 3.50.0 | 2 / 3 | |
| 3.49.7 | 2 / 3 | |
| 3.49.6 | 2 / 3 | |
| 3.49.5 | 2 / 3 | |
| 3.49.4 | 2 / 3 | |
| 3.49.3 | 2 / 3 | |
| 3.49.2 | 2 / 3 | |
| 3.49.1 | 2 / 3 | |
| 3.49.0 | 2 / 3 | |
| 3.48.6 | 2 / 3 | |
| 3.48.5 | 2 / 3 | |
| 3.48.4 | 2 / 3 | |
| 3.48.3 | 2 / 3 | |
| 3.48.2 | 2 / 3 | |
| 3.48.1 | 2 / 3 | |
| 3.48.0 | 2 / 3 | |
| 3.47.5 | 2 / 3 | |
| 3.47.4 | 2 / 3 | |
| 3.47.3 | 2 / 3 | |
| 3.47.2 | 2 / 3 | |
| 3.47.1 | 2 / 3 | |
| 3.47.0 | 2 / 3 | |
| 3.46.5 | 2 / 3 | |
| 3.46.4 | 2 / 3 | |
| 3.46.3 | 2 / 3 | |
| 3.46.2 | 2 / 3 | |
| 3.46.1 | 2 / 3 | |
| 3.46.0 | 2 / 3 | |
| 3.45.4 | 2 / 3 | |
| 3.45.3 | 2 / 3 | |
| 3.45.2 | 2 / 3 | |
| 3.45.1 | 2 / 3 | |
| 3.45.0 | 2 / 3 | |
| 3.44.1 | 2 / 3 | |
| 3.44.0 | 2 / 3 | |
| 3.43.0 | 2 / 3 | |
| 3.42.0 | 2 / 3 | |
| 3.41.2 | 2 / 3 | |
| 3.41.1 | 2 / 3 | |
| 3.41.0 | 2 / 3 | |
| 3.40.3 | 2 / 3 | |
| 3.40.2 | 2 / 3 | |
| 3.40.1 | 2 / 3 | |
| 3.40.0 | 2 / 3 | |
| 3.39.0 | 2 / 3 | |
| 3.38.0 | 2 / 3 | |
| 3.37.0 | 2 / 3 | |
| 3.36.2 | 2 / 3 | |
| 3.36.1 | 2 / 3 | |
| 3.36.0 | 2 / 3 | |
| 3.35.0 | 2 / 3 | |
| 3.34.0 | 2 / 3 | |
| 3.33.0 | 2 / 3 | |
| 3.32.1 | 2 / 3 | |
| 3.32.0 | 2 / 3 | |
| 3.31.1 | 2 / 2 | |
| 3.31.0 | 2 / 2 | |
| 3.30.2 | 2 / 2 | |
| 3.30.1 | 2 / 2 | |
| 3.30.0 | 2 / 2 | |
| 3.29.0 | 2 / 2 | |
| 3.28.0 | 2 / 2 | |
| 3.27.0 | 2 / 2 | |
| 3.26.0 | 2 / 2 | |
| 3.25.0 | 2 / 1 | |
| 3.24.1 | 2 / 1 | |
| 3.23.0 | 2 / 1 | |
| 3.22.1 | 2 / 1 | |
| 3.22.0 | 2 / 1 |
v3.58.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.58.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.58.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.57.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.57.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.56.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.56.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.56.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.56.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.55.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.55.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.55.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.55.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.55.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.54.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.53.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.53.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.52.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.51.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.51.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.51.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.50.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.50.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.50.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.49.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.49.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.49.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.49.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.49.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.49.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.49.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.49.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.48.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.48.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.48.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.48.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.48.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.48.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.48.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.47.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.47.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.47.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.47.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.47.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.47.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.46.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.46.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.46.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.46.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.46.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.46.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.45.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.45.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.45.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.45.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.45.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.44.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.44.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.43.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.42.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.41.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.41.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.41.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.40.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.40.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.40.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.40.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.39.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.38.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.37.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.36.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.36.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.36.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.35.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.34.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.33.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.32.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.32.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.31.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.31.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.30.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.30.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.30.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.29.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.28.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.27.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.26.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.25.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.24.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.23.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.22.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.22.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.