@cucumber/cucumber
The official JavaScript implementation of Cucumber.
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@cucumber/cucumber-expressions | AI (dependencies): First-party @cucumber org dependency. | ai | |
| dependencies | unvetted-dep:@cucumber/tag-expressions | AI (dependencies): First-party @cucumber org dependency. | ai | |
| dependencies | unvetted-dep:assertion-error-formatter | AI (dependencies): Legitimate dependency of established cucumber-js package. | ai | |
| dependencies | unvetted-dep:@cucumber/pretty-formatter | AI (dependencies): First-party @cucumber org dependency. | ai | |
| dependencies | unvetted-dep:@cucumber/junit-xml-formatter | AI (dependencies): First-party @cucumber org dependency. | ai | |
| dependencies | unvetted-dep:figures | AI (dependencies): Legitimate dependency of established cucumber-js package. | ai | |
| dependencies | unvetted-dep:@cucumber/gherkin | AI (dependencies): First-party @cucumber org dependency. | ai | |
| dependencies | unvetted-dep:@cucumber/messages | AI (dependencies): First-party @cucumber org dependency. | ai | |
| dependencies | unvetted-dep:knuth-shuffle-seeded | AI (dependencies): Legitimate dependency of established cucumber-js package. | ai | |
| dependencies | unvetted-dep:@cucumber/gherkin-utils | AI (dependencies): First-party @cucumber org dependency. | ai | |
| dependencies | unvetted-dep:@cucumber/ci-environment | AI (dependencies): First-party @cucumber org dependency. | ai | |
| dependencies | unvetted-dep:@cucumber/html-formatter | AI (dependencies): First-party @cucumber org dependency. | ai | |
| dependencies | unvetted-dep:@cucumber/gherkin-streams | AI (dependencies): First-party @cucumber org dependency. | ai | |
| dependencies | unvetted-dep:@cucumber/message-streams | AI (dependencies): First-party @cucumber org dependency. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Reflect.get used in a Proxy handler for scope management, not for obfuscation or evasion. | ai | |
| phantom-deps | phantom-dep:@cucumber/pretty-formatter | AI (phantom-deps): Same-org formatter dependency; declared as runtime dep for optional use, stable false positive. | ai | |
| phantom-deps | phantom-dep:@cucumber/junit-xml-formatter | AI (phantom-deps): Same-org formatter dependency; declared as runtime dep for optional use, stable false positive. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Config file loader pattern — loads user-specified .js/.cjs config files by path, not arbitrary attacker-controlled input. | ai |
Versions (showing 13 of 13)
| Version | Deps | Published |
|---|---|---|
| 12.9.0 | 39 / 54 | |
| 12.8.3 | 39 / 54 | |
| 12.8.2 | 39 / 54 | |
| 12.8.1 | 39 / 54 | |
| 12.8.0 | 39 / 54 | |
| 12.7.0 | 40 / 54 | |
| 12.6.0 | 40 / 54 | |
| 12.5.0 | 40 / 54 | |
| 12.4.0 | 40 / 54 | |
| 12.3.0 | 40 / 54 | |
| 12.2.0 | 40 / 54 | |
| 12.1.0 | 39 / 56 | |
| 12.0.0 | 39 / 55 |
v12.9.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v12.8.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v12.8.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v12.8.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v12.8.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v12.7.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v12.6.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v12.5.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v12.4.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v12.3.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v12.2.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v12.1.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v12.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.