next-rspack
> [!WARNING] > This package is currently experimental. It's not an official Next.js plugin, and is supported by the Rspack team in partnership with Next.js. Help improve Next.js and Rspack by providing feedback at https://github.com/vercel/next.js/discuss
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Vercel migrated publishing to GitHub Actions CI with SLSA attestation; not a hostile takeover. | ai | |
| phantom-deps | phantom-dep:@rspack/core | AI (phantom-deps): Config-file reference pattern for rspack integration; not a direct import by design. | ai | |
| phantom-deps | phantom-dep:react-refresh | AI (phantom-deps): Config-file reference pattern; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@rspack/plugin-react-refresh | AI (phantom-deps): Config-file reference pattern; stable false positive for this package. | ai | |
| dependencies | unvetted-dep:@next/rspack-core | AI (dependencies): First-party Vercel package published alongside next-rspack; stable false positive for this package. | ai |
Versions (showing 51 of 54)
| Version | Deps | Published |
|---|---|---|
| 16.2.12 | 1 / 0 | |
| 16.2.11 | 1 / 0 | |
| 16.2.9 | 1 / 0 | |
| 16.2.8 | 1 / 0 | |
| 16.2.7 | 1 / 0 | |
| 16.2.6 | 1 / 0 | |
| 16.2.5 | 1 / 0 | |
| 16.2.4 | 1 / 0 | |
| 16.2.3 | 1 / 0 | |
| 16.2.2 | 1 / 0 | |
| 16.2.1 | 1 / 0 | |
| 16.2.0 | 1 / 0 | |
| 16.1.7 | 1 / 0 | |
| 16.1.6 | 1 / 0 | |
| 16.1.5 | 1 / 0 | |
| 16.1.4 | 1 / 0 | |
| 16.1.3 | 1 / 0 | |
| 16.1.2 | 1 / 0 | |
| 16.1.1 | 1 / 0 | |
| 16.1.0 | 1 / 0 | |
| 16.0.11 | 1 / 0 | |
| 16.0.10 | 1 / 0 | |
| 16.0.9 | 1 / 0 | |
| 16.0.8 | 1 / 0 | |
| 16.0.7 | 1 / 0 | |
| 16.0.6 | 1 / 0 | |
| 16.0.5 | 1 / 0 | |
| 16.0.4 | 1 / 0 | |
| 16.0.3 | 1 / 0 | |
| 16.0.2 | 1 / 0 | |
| 16.0.1 | 1 / 0 | |
| 16.0.0 | 1 / 0 | |
| 15.5.22 | 3 / 0 | |
| 15.5.20 | 3 / 0 | |
| 15.5.19 | 3 / 0 | |
| 15.5.18 | 3 / 0 | |
| 15.5.16 | 3 / 0 | |
| 15.5.15 | 3 / 0 | |
| 15.5.14 | 3 / 0 | |
| 15.5.13 | 3 / 0 | |
| 15.5.12 | 3 / 0 | |
| 15.5.11 | 3 / 0 | |
| 15.5.10 | 3 / 0 | |
| 15.5.9 | 3 / 0 | |
| 15.5.8 | 3 / 0 | |
| 15.5.7 | 3 / 0 | |
| 15.4.11 | 3 / 0 | |
| 15.4.10 | 3 / 0 | |
| 15.4.9 | 3 / 0 | |
| 15.4.8 | 3 / 0 | |
| 15.3.9 | 3 / 0 |
v16.2.12
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v16.2.11
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v15.5.22
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v15.5.20
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.