docusaurus

Supply chain provenance

Status for the latest visible version.

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

Keywords

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
semgrep	semgrep:dynamic-require	AI (semgrep): Dynamic requires load user project config/data files (e.g., versions.json) relative to CWD — standard Docusaurus v1 pattern, not arbitrary code execution.	ai	2026/04/28
phantom-deps	phantom-dep:enzyme	AI (phantom-deps): enzyme is a test utility declared as a dep for user projects; not directly imported by framework code.	ai	2026/04/28
phantom-deps	phantom-dep:enzyme-adapter-react-16	AI (phantom-deps): Test adapter declared for user project use; stable false positive for this package.	ai	2026/04/28
phantom-deps	phantom-dep:crowdin-cli	AI (phantom-deps): CLI tool invoked via shell commands, not require(); phantom-dep is a false positive here.	ai	2026/04/28
phantom-deps	phantom-dep:tcp-port-used	AI (phantom-deps): Used in server startup scripts; phantom-dep heuristic misfires on indirect usage patterns.	ai	2026/04/28
phantom-deps	phantom-dep:@babel/core	AI (phantom-deps): Framework-scoped Babel package loaded by convention; stable false positive for this package.	ai	2026/04/28
phantom-deps	phantom-dep:@babel/types	AI (phantom-deps): Framework-scoped Babel package loaded by convention; stable false positive for this package.	ai	2026/04/28

Version	Deps	Published
1.14.7	48 / 4	2021-03-09