← Home

@univerjs/engine-formula

npm Repository Homepage

UniverSheet normal base-formula-engine

8
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

jikkaiwbfsamengshukeji

Keywords

univerformulaformula-enginecalculationspreadsheet

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
dependencies unvetted-dep:@univerjs/engine-numfmt AI (dependencies): Sibling package in same monorepo/version-locked release. ai
semgrep semgrep:new-function-constructor AI (semgrep): Bundled formula-parser code; dynamic eval is expected functionality, not injected behavior. ai
phantom-deps phantom-dep:big.js AI (phantom-deps): Used via config/build indirection; stable false positive. ai
phantom-deps phantom-dep:numfmt AI (phantom-deps): Used via config/build indirection; stable false positive. ai
phantom-deps phantom-dep:decimal.js AI (phantom-deps): decimal.js is a declared runtime dependency in package.json; phantom-dep is a false positive for this package. ai
dependencies unvetted-dep:@univerjs/core AI (dependencies): Internal sibling package from the same DreamNum/Univer monorepo; expected dependency pattern. ai
dependencies unvetted-dep:@univerjs/rpc AI (dependencies): Internal sibling package from the same DreamNum/Univer monorepo; expected dependency pattern. ai

Versions (showing 8 of 108)

Version Deps Published
0.1.8 2 / 8
0.1.7 2 / 8
0.1.6 2 / 8
0.1.5 2 / 8
0.1.4 2 / 8
0.1.3 1 / 9
0.1.2 1 / 9
0.1.1 1 / 9

v0.1.8

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.7

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.