react-querybuilder
47
Versions
—
License
No
Install Scripts
Attested
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation (unverified)
npm registry signatures
gitHead linked
Maintainers
pavanpodilajakeboone02
Keywords
reactquerybuilderquerybuilderoperatorscomponentclauseexpressionsql
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/defaults-DF2o4Psf.mjs | AI (source-diff): Minified bundler output from documented build scripts, not obfuscation; code is legitimate component logic. | ai | |
| source-diff | obfuscated-file:dist/cjs/defaults-Bx0cjPJ6.js | AI (source-diff): Minified bundler output from documented build scripts, not obfuscation; code is legitimate component logic. | ai | |
| source-diff | obfuscated-file:dist/defaults-CBQzMSxg.mjs | AI (source-diff): Minified ESM bundle output with source maps; standard for this package's build pipeline. | ai | |
| source-diff | obfuscated-file:dist/cjs/defaults-BXxJnqRA.js | AI (source-diff): Minified bundle output with source maps; standard for this package's build pipeline. | ai | |
| source-diff | obfuscated-file:dist/cjs/defaults-DlULsmVo.js | AI (source-diff): Standard minified CJS build output for this package; not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/defaults-DdbJzdA7.mjs | AI (source-diff): Standard minified ESM build output for this package; not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/defaults-qvnDsdSN.mjs | AI (source-diff): Minified ESM build output; standard for this package's dist bundle. | ai | |
| source-diff | obfuscated-file:dist/cjs/defaults-Cue9furi.js | AI (source-diff): Minified CJS build output; standard for this package's dist bundle. | ai | |
| source-diff | obfuscated-file:dist/defaults-FmvgcbMr.mjs | AI (source-diff): Minified ESM build output with source maps; standard for this package. | ai | |
| source-diff | obfuscated-file:dist/cjs/defaults-Bfg8sl9R.js | AI (source-diff): Minified CJS build output with source maps; standard for this package. | ai | |
| source-diff | obfuscated-file:dist/defaults-CjxtrGpV.mjs | AI (source-diff): Minified ESM build output with source maps; standard for this package. | ai | |
| source-diff | obfuscated-file:dist/cjs/defaults-BGa0Vm6P.js | AI (source-diff): Minified CJS build output with source maps; standard for this package. | ai | |
| source-diff | obfuscated-file:dist/cjs/defaults-DG-43aVv.js | AI (source-diff): Standard CJS minified bundle output for this package; not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/defaults-DP2ciVM_.mjs | AI (source-diff): Standard ESM minified bundle output for this package; not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/cjs/selectors-eF1uIKk7.d.ts | AI (source-diff): TypeScript declaration file with long type-import lines; not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/cjs/QueryBuilderInternal-BwqvepR5.js | AI (source-diff): Standard CJS bundle output for a React UI library; not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/selectors-CeJZAUve.d.mts | AI (source-diff): TypeScript declaration file with long type-import lines; not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/selectors-BGz34G2G.d.ts | AI (source-diff): TypeScript declaration file with long type-import lines; not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/cjs/QueryBuilderInternal-COiFuar7.js | AI (source-diff): Standard CJS bundle output; sample shows normal React component code. | ai | |
| source-diff | obfuscated-file:dist/selectors-D5W5Fm21.d.ts | AI (source-diff): TypeScript declaration file with long import/type lines, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/cjs/selectors-CVtJeEb2.d.ts | AI (source-diff): TypeScript declaration file with long import/type lines, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/selectors-Cx23IzLm.d.mts | AI (source-diff): TypeScript declaration file with long import/type lines, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/react-querybuilder.legacy-esm.debug.js | AI (source-diff): ESM legacy bundle; long import/export lines expected. | ai | |
| source-diff | obfuscated-file:dist/cjs/QueryBuilderInternal-DI84K4mA.js | AI (source-diff): CJS bundle output; minification is expected. | ai | |
| source-diff | obfuscated-file:dist/QueryBuilderInternal-CsaHY6ZX.js | AI (source-diff): Standard bundled build output for this React component library. | ai | |
| source-diff | obfuscated-file:dist/QueryBuilderInternal-CrUkpBSt.mjs | AI (source-diff): ESM bundle output; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/react-querybuilder.debug.mjs | AI (source-diff): ESM debug bundle; long re-export lines expected. | ai | |
| source-diff | net-exec-file:dist/parseSpEL.js | AI (source-diff): Bundled spel2js dependency using webpack UMD wrapper; no actual network calls. | ai | |
| source-diff | obfuscated-file:dist/cjs/defaults-D0CcjGMM.js | AI (source-diff): Standard CJS bundle output from build tooling; readable React component code, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/index-Dxdojb6L.d.ts | AI (source-diff): TypeScript declaration file with long import lines; not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/cjs/index-CW_Rquzk.d.ts | AI (source-diff): TypeScript declaration file with long import lines; not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/index-CKUNH5Wo.d.mts | AI (source-diff): TypeScript declaration file with long import lines; not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/cjs/QueryBuilderInternal-Beh3zChi.js | AI (source-diff): Standard CJS bundle output for a React UI library; not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/cjs/selectors-CmnAnlAh.d.ts | AI (source-diff): Bundled TypeScript declarations with long import lines; not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/selectors-ByLiddiX.d.ts | AI (source-diff): Bundled TypeScript declarations with long import lines; not obfuscation. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Gap due to version diff baseline (v8.8.3→v8.10.0); publisher is long-standing maintainer with SLSA provenance. | ai | |
| source-diff | obfuscated-file:dist/selectors-B8GSo6OV.d.mts | AI (source-diff): Bundled TypeScript declarations with long import lines; not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/react-querybuilder.production.debug.mjs | AI (source-diff): Minified ESM production bundle; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/cjs/react-querybuilder.cjs.development.debug.js | AI (source-diff): Standard CJS bundle output from esbuild; not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/cjs/react-querybuilder.cjs.production.debug.js | AI (source-diff): Minified production CJS bundle; standard build artifact. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Major version jump (v6→v8) naturally adds many files; legitimate growth. | ai | |
| source-diff | obfuscated-file:dist/index-j_WbTz3x.d.ts | AI (source-diff): TypeScript declaration bundle; standard build output with long type definition lines. | ai | |
| source-diff | obfuscated-file:dist/cjs/index-DE2I7dH8.d.ts | AI (source-diff): CJS TypeScript declaration bundle; long lines from type definitions, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/index-BtVfLjYK.d.mts | AI (source-diff): TypeScript declaration bundle with long type definition lines; not obfuscated code. | ai | |
| source-diff | obfuscated-file:dist/cjs/defaults-CbhYCkvn.js | AI (source-diff): Minified CJS bundle output with readable React component code; standard build artifact for this package. | ai | |
| source-diff | obfuscated-file:dist/defaults-ilE2Nhxw.mjs | AI (source-diff): Minified ESM bundle output with standard React imports; build artifact, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/index-CJ_xNf4H.d.ts | AI (source-diff): Bundler-generated TypeScript declaration file; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/cjs/index-C2koG0fE.d.ts | AI (source-diff): Bundler-generated TypeScript declaration file; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-CfYDBuoo.d.mts | AI (source-diff): Bundler-generated TypeScript declaration file with long import lines; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/defaults-mONjSyj5.mjs | AI (source-diff): Standard minified ESM bundle output from build toolchain; readable React component code, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/cjs/defaults-D1GGb3V5.js | AI (source-diff): Standard minified CJS bundle output from build toolchain; readable React component code, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/index-ByOIcr_e.d.mts | AI (source-diff): TypeScript declaration file with long import lines from bundler output; not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/cjs/index-D79qEKcc.d.ts | AI (source-diff): CJS TypeScript declaration file; long lines from bundled type imports. | ai | |
| source-diff | obfuscated-file:dist/index-ByIV7_Fn.d.ts | AI (source-diff): TypeScript declaration file with bundled type definitions; not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/cjs/defaults-BEGWID14.js | AI (source-diff): Standard CJS bundle chunk with minified React component code; not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/react-querybuilder.legacy-esm.d.ts | AI (source-diff): Bundled TypeScript declaration file; long lines from bundler, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/cjs/react-querybuilder.cjs.production.debug.d.ts | AI (source-diff): Bundled TypeScript declaration re-exports; standard bundler output. | ai | |
| source-diff | obfuscated-file:dist/cjs/react-querybuilder.cjs.development.debug.d.ts | AI (source-diff): Bundled TypeScript declaration re-exports; standard bundler output. | ai | |
| source-diff | obfuscated-file:dist/index-JBfP2YhA.d.ts | AI (source-diff): TypeScript declaration file with long import lines from bundler output; not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/cjs/index-BOVxaFa6.d.ts | AI (source-diff): TypeScript declaration file with long import lines from bundler output; not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/react-querybuilder.production.debug.d.mts | AI (source-diff): Bundled TypeScript declaration re-exports; long lines are standard bundler output. | ai | |
| source-diff | obfuscated-file:dist/react-querybuilder.debug.d.mts | AI (source-diff): Bundled TypeScript declaration re-exports; long lines are standard bundler output. | ai | |
| source-diff | obfuscated-file:dist/index-D3JEI-JA.d.mts | AI (source-diff): TypeScript declaration file with long import lines from bundler output; not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/cjs/defaults-B_HAlgZZ.js | AI (source-diff): Standard minified CJS bundle output for a React component library; content is clearly readable React code. | ai | |
| source-diff | obfuscated-file:dist/react-querybuilder.legacy-esm.debug.d.ts | AI (source-diff): Bundled TypeScript declaration file; long lines from bundler, not obfuscation. | ai | |
| provenance | publisher-changed | AI (provenance): Transition from manual (jakeboone02) to GitHub Actions CI/CD publishing with SLSA provenance attestation. Standard modern practice. | ai | |
| provenance | slsa-provenance | AI (provenance): Valid SLSA provenance attestation confirms CI/CD publishing integrity. | ai | |
| source-diff | obfuscated-file:dist/defaults-Lvgl_od3.mjs | AI (source-diff): Minified build output (ESM bundle) with source maps included. Contains standard React component code, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/cjs/defaults-C8GR3Tnu.js | AI (source-diff): Minified build output (CJS bundle) with source maps included. Contains standard React component code, not obfuscation. | ai | |
| dependencies | unvetted-dep:@react-querybuilder/core | AI (dependencies): @react-querybuilder/core is the package's own scoped monorepo sibling; it is expected and benign for this package to depend on it. | ai |
Versions (showing 47 of 47)
| Version | Deps | Published |
|---|---|---|
| 8.21.2 | 3 / 15 | |
| 8.21.1 | 3 / 15 | |
| 8.21.0 | 3 / 15 | |
| 8.20.2 | 3 / 15 | |
| 8.20.1 | 3 / 16 | |
| 8.20.0 | 3 / 16 | |
| 8.19.1 | 3 / 16 | |
| 8.19.0 | 3 / 16 | |
| 8.18.0 | 3 / 16 | |
| 8.17.0 | 3 / 16 | |
| 8.16.2 | 3 / 16 | |
| 8.16.1 | 3 / 16 | |
| 8.16.0 | 3 / 16 | |
| 8.15.0 | 3 / 16 | |
| 8.14.4 | 3 / 22 | |
| 8.14.3 | 3 / 22 | |
| 8.14.2 | 3 / 22 | |
| 8.14.1 | 3 / 22 | |
| 8.14.0 | 4 / 23 | |
| 8.13.0 | 4 / 23 | |
| 8.12.0 | 4 / 23 | |
| 8.11.2 | 4 / 23 | |
| 8.11.1 | 4 / 23 | |
| 8.11.0 | 5 / 23 | |
| 8.10.0 | 5 / 23 | |
| 8.9.2 | 5 / 21 | |
| 8.9.1 | 5 / 21 | |
| 8.8.4 | 4 / 36 | |
| 8.8.3 | 4 / 36 | |
| 8.8.2 | 4 / 36 | |
| 8.8.1 | 4 / 36 | |
| 8.8.0 | 4 / 36 | |
| 8.7.1 | 4 / 36 | |
| 8.7.0 | 4 / 36 | |
| 8.6.2 | 4 / 31 | |
| 8.6.1 | 4 / 31 | |
| 8.6.0 | 4 / 31 | |
| 8.5.0 | 4 / 31 | |
| 8.4.1 | 4 / 31 | |
| 8.4.0 | 4 / 31 | |
| 8.3.1 | 4 / 31 | |
| 8.3.0 | 4 / 31 | |
| 8.2.0 | 4 / 31 | |
| 8.1.1 | 4 / 31 | |
| 8.1.0 | 4 / 31 | |
| 8.0.0 | 4 / 29 | |
| 6.5.1 | 2 / 24 |
v8.21.2
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v8.21.1
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v8.21.0
3 findings
HIGH
New obfuscated file: dist/cjs/defaults-Bx0cjPJ6.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: dist/defaults-DF2o4Psf.mjs
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v8.5.0
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v8.4.1
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v8.4.0
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v8.3.1
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v8.3.0
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v8.2.0
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v8.1.1
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v8.1.0
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v8.0.0
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.