@docusaurus/bundler
Docusaurus util package to abstract the current bundler.
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | no-provenance | AI (provenance): Canary releases from established publishers often lack provenance; not a concern for this trusted monorepo package. | ai | |
| dependencies | unvetted-dep:babel-loader | AI (dependencies): babel-loader is a standard webpack loader; expected dependency for a bundler utility. | ai | |
| dependencies | unvetted-peer-dep:@docusaurus/faster | AI (dependencies): Optional peer dependency for Docusaurus framework; marked optional in peerDependenciesMeta. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Bundler expansion with new build features; 21 files is expected for this package's scope. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase reflects legitimate bundler feature expansion, not injected code. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): 18 new deps are canonical build tools (webpack, babel, postcss, terser, etc.); expected for bundler package. | ai | |
| provenance | publisher-changed | AI (provenance): Legitimate CI/CD transition from docusaurus-bot to GitHub Actions; SLSA provenance attestation confirms integrity. | ai | |
| dependencies | unvetted-dep:webpack | AI (dependencies): Webpack is a canonical, widely-trusted bundler; appropriate core dependency for this package. | ai | |
| phantom-deps | phantom-dep:clean-css | AI (phantom-deps): Bundler package; clean-css is referenced in webpack config, not direct import. Stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:@babel/core | AI (phantom-deps): Framework-scoped package loaded by convention in bundler context. Stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:cssnano | AI (phantom-deps): Bundler package; cssnano is referenced in webpack config, not direct import. Stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:postcss | AI (phantom-deps): Bundler package; postcss is referenced in webpack config, not direct import. Stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:url-loader | AI (phantom-deps): Bundler package; url-loader is referenced in webpack config, not direct import. Stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:file-loader | AI (phantom-deps): Bundler package; file-loader is referenced in webpack config, not direct import. Stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:@docusaurus/utils | AI (phantom-deps): Same-org scoped package in monorepo; loaded by convention. Stable pattern for this package. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Internal Docusaurus monorepo package; 'fb' spam signal is false positive (Facebook org owner). README and keyword signals are expected for framework-internal utilities. | ai |
Versions (showing 14 of 14)
| Version | Deps | Published |
|---|---|---|
| 3.10.1 | 24 / 1 | |
| 3.10.0 | 24 / 1 | |
| 3.9.2 | 24 / 1 | |
| 3.9.1 | 24 / 1 | |
| 3.9.0 | 24 / 1 | |
| 3.8.1 | 24 / 1 | |
| 3.8.0 | 24 / 1 | |
| 3.7.0 | 25 / 1 | |
| 3.6.3 | 25 / 1 | |
| 3.6.2 | 25 / 1 | |
| 3.6.1 | 25 / 1 | |
| 3.6.0 | 25 / 1 | |
| 3.5.2 | 7 / 0 | |
| 3.8.1-canary-6388 | 24 / 1 |
v3.10.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.9.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2025-09-25. This could indicate a legitimate maintainer transition or an account compromise.
v3.6.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.6.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.5.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.8.1-canary-6388
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2025-09-04. This could indicate a legitimate maintainer transition or an account compromise.