@tramvai/plugin-rspack-builder
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| bogus-package | bogus-package | AI (bogus-package): Internal monorepo build plugin; missing metadata is consistent with the tramvai package family pattern. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require is used to read package.json files for dependency path resolution — standard build-tool pattern, not arbitrary code loading. | ai | |
| phantom-deps | phantom-dep:svgo | AI (phantom-deps): svgo is a declared dependency used via config/plugin references in a build tool; phantom-dep heuristic is a false positive here. | ai | |
| phantom-deps | phantom-dep:file-loader | AI (phantom-deps): file-loader referenced in rspack/webpack config; phantom-dep heuristic false positive for build plugins. | ai | |
| phantom-deps | phantom-dep:@svgr/webpack | AI (phantom-deps): webpack plugin referenced in config; phantom-dep heuristic false positive for build plugins. | ai | |
| phantom-deps | phantom-dep:lightningcss-loader | AI (phantom-deps): CSS loader referenced in config; phantom-dep heuristic false positive for build plugins. | ai |
Versions (showing 58 of 58)
| Version | Deps | Published |
|---|---|---|
| 7.33.1 | 24 / 4 | |
| 7.32.0 | 24 / 4 | |
| 7.31.1 | 24 / 4 | |
| 7.30.1 | 24 / 4 | |
| 7.30.0 | 24 / 4 | |
| 7.29.0 | 24 / 4 | |
| 7.28.1 | 24 / 4 | |
| 7.28.0 | 24 / 4 | |
| 7.27.9 | 24 / 4 | |
| 7.27.8 | 24 / 4 | |
| 7.27.7 | 24 / 4 | |
| 7.27.6 | 24 / 4 | |
| 7.27.4 | 24 / 4 | |
| 7.27.3 | 24 / 4 | |
| 7.27.0 | 24 / 4 | |
| 7.26.9 | 24 / 4 | |
| 7.26.8 | 24 / 4 | |
| 7.21.1 | 23 / 4 | |
| 7.21.0 | 23 / 4 | |
| 7.20.1 | 23 / 4 | |
| 7.19.1 | 23 / 4 | |
| 7.18.0 | 23 / 4 | |
| 7.17.6 | 23 / 4 | |
| 7.17.5 | 23 / 4 | |
| 7.17.2 | 23 / 4 | |
| 7.17.1 | 23 / 4 | |
| 7.16.1 | 23 / 4 | |
| 7.16.0 | 23 / 4 | |
| 6.82.21 | 24 / 4 | |
| 6.82.19 | 24 / 4 | |
| 6.82.18 | 24 / 4 | |
| 6.82.13 | 24 / 4 | |
| 6.82.12 | 24 / 4 | |
| 6.82.11 | 24 / 4 | |
| 6.82.10 | 24 / 4 | |
| 6.82.9 | 24 / 4 | |
| 6.82.8 | 24 / 4 | |
| 6.82.5 | 24 / 4 | |
| 6.82.4 | 24 / 4 | |
| 6.82.3 | 24 / 4 | |
| 6.82.1 | 24 / 4 | |
| 6.82.0 | 24 / 4 | |
| 6.81.18 | 24 / 4 | |
| 6.81.13 | 24 / 4 | |
| 6.81.12 | 24 / 4 | |
| 6.81.11 | 24 / 4 | |
| 6.80.26 | 23 / 4 | |
| 6.80.25 | 23 / 4 | |
| 6.80.23 | 23 / 4 | |
| 6.80.19 | 23 / 4 | |
| 6.80.16 | 23 / 4 | |
| 6.80.14 | 23 / 4 | |
| 6.80.13 | 23 / 4 | |
| 6.80.11 | 23 / 4 | |
| 6.80.10 | 23 / 4 | |
| 6.80.8 | 23 / 4 | |
| 6.80.7 | 23 / 4 | |
| 6.80.6 | 23 / 4 |
v7.33.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.32.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.31.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.30.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.30.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.29.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.28.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.28.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.27.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.27.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.27.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.82.21
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.82.19
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.82.18
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.82.13
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.82.12
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.82.11
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.82.10
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.82.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.82.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.82.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.