@codemirror/lang-html
HTML language support for the CodeMirror code editor
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:lezer-tree | AI (phantom-deps): lezer-tree is a legitimate declared dependency in the CodeMirror/Lezer ecosystem; phantom detection is a false positive for this bundled package. | ai | |
| phantom-deps | phantom-dep:@codemirror/autocomplete | AI (phantom-deps): Same-org dependency legitimately declared; phantom detection is a false positive for this bundled CodeMirror package. | ai | |
| provenance | no-provenance | AI (provenance): Marijn Haverbeke is the canonical CodeMirror author with a 4957-day track record; lack of Sigstore provenance is not a meaningful risk signal for this publisher. | ai | |
| phantom-deps | phantom-dep:@lezer/css | AI (phantom-deps): @lezer/css is a legitimate sibling package in the Lezer ecosystem; referenced in config files as part of the build setup, not a security concern. | ai |
Versions (showing 31 of 31)
| Version | Deps | Published |
|---|---|---|
| 6.4.11 | 9 / 1 | |
| 6.4.10 | 9 / 1 | |
| 6.4.9 | 9 / 1 | |
| 6.4.8 | 9 / 1 | |
| 6.4.7 | 9 / 1 | |
| 6.4.6 | 9 / 1 | |
| 6.4.5 | 9 / 1 | |
| 6.4.4 | 9 / 1 | |
| 6.4.3 | 9 / 1 | |
| 6.4.2 | 9 / 1 | |
| 6.4.1 | 9 / 1 | |
| 6.4.0 | 9 / 1 | |
| 6.3.1 | 8 / 1 | |
| 6.3.0 | 8 / 1 | |
| 6.2.0 | 8 / 1 | |
| 6.1.4 | 8 / 1 | |
| 6.1.3 | 8 / 1 | |
| 6.1.2 | 8 / 1 | |
| 6.1.1 | 8 / 1 | |
| 6.1.0 | 7 / 1 | |
| 6.0.0 | 7 / 1 | |
| 0.20.0 | 7 / 1 | |
| 0.19.4 | 8 / 1 | |
| 0.19.3 | 8 / 1 | |
| 0.19.2 | 8 / 1 | |
| 0.19.1 | 8 / 1 | |
| 0.19.0 | 8 / 1 | |
| 0.18.1 | 8 / 1 | |
| 0.18.0 | 8 / 6 | |
| 0.17.1 | 8 / 6 | |
| 0.17.0 | 8 / 6 |
v6.4.10
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.4.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.4.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.4.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.4.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.4.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.4.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.4.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.4.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.4.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.4.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.3.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.3.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.2.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.1.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.1.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.1.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.1.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.20.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.19.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.19.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.19.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.19.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.19.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.18.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.18.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.