docxtemplater
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| install-scripts | install-script:postinstall | AI (install-scripts): Postinstall only prints a console banner; no network/fs behavior, stable across versions. | ai | |
| dependencies | unvetted-dep:xmldom | AI (dependencies): Long-standing legitimate XML parser dependency, stable across versions. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Template engine compiles rendered getters via new Function; core to stated function. | ai | |
| semgrep | semgrep:eval-usage | AI (semgrep): eval in browser demo main.js on textarea contents; stable FP. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process in test-watch dev helper, not runtime. | ai | |
| npm-metadata | url-dep:eslint-plugin-specific-sort | AI (npm-metadata): Local file: devDependency for internal eslint rules, not a runtime/registry risk. | ai |
Versions (showing 51 of 201)
| Version | Deps | Published |
|---|---|---|
| 3.69.3 | 1 / 39 | |
| 3.69.2 | 1 / 39 | |
| 3.69.0 | 1 / 39 | |
| 3.68.7 | 1 / 39 | |
| 3.68.6 | 1 / 39 | |
| 3.68.5 | 1 / 39 | |
| 3.68.4 | 1 / 39 | |
| 3.68.3 | 1 / 39 | |
| 3.68.2 | 1 / 39 | |
| 3.68.1 | 1 / 39 | |
| 3.68.0 | 1 / 39 | |
| 3.67.6 | 1 / 39 | |
| 3.67.5 | 1 / 39 | |
| 3.67.4 | 1 / 39 | |
| 3.67.3 | 1 / 39 | |
| 3.67.2 | 1 / 39 | |
| 3.67.1 | 1 / 39 | |
| 3.67.0 | 1 / 39 | |
| 3.66.7 | 1 / 39 | |
| 3.66.6 | 1 / 39 | |
| 3.66.5 | 1 / 39 | |
| 3.66.4 | 1 / 40 | |
| 3.66.3 | 1 / 40 | |
| 3.66.2 | 1 / 40 | |
| 3.66.1 | 1 / 40 | |
| 3.66.0 | 1 / 40 | |
| 3.65.3 | 1 / 38 | |
| 3.65.2 | 1 / 39 | |
| 3.65.1 | 1 / 39 | |
| 3.65.0 | 1 / 39 | |
| 3.64.0 | 1 / 39 | |
| 3.63.4 | 1 / 39 | |
| 3.63.3 | 1 / 39 | |
| 3.63.2 | 1 / 39 | |
| 3.63.1 | 1 / 39 | |
| 3.63.0 | 1 / 39 | |
| 3.62.2 | 1 / 39 | |
| 3.62.1 | 1 / 39 | |
| 3.62.0 | 1 / 39 | |
| 3.61.2 | 1 / 39 | |
| 3.61.1 | 1 / 39 | |
| 3.61.0 | 1 / 39 | |
| 3.60.2 | 1 / 39 | |
| 3.60.1 | 1 / 39 | |
| 3.60.0 | 1 / 39 | |
| 3.59.0 | 1 / 40 | |
| 3.58.4 | 1 / 40 | |
| 3.58.3 | 1 / 40 | |
| 3.58.2 | 1 / 40 | |
| 3.58.1 | 1 / 39 | |
| 3.58.0 | 1 / 39 |
v3.69.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.69.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.61.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.61.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.60.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.60.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.60.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.59.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.58.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.58.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.58.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.58.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.58.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.