@mdn/browser-compat-data
Browser compatibility data provided by MDN Web Docs
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require() loads the package's own bundled JSON compat data files via filesystem traversal — not user-controlled input. This is the package's core data-loading mechanism. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process is used only in dev/scripts tooling (fix-format.js), not in runtime code or install hooks. No risk to package consumers. | ai | |
| provenance | no-provenance | AI (provenance): Official MDN/Mozilla package with 2000+ day history and clean publisher record. Lack of Sigstore provenance is acceptable given strong ecosystem trust signals. | ai | |
| provenance | publisher-changed | AI (provenance): MDN BCD transitioned to GitHub Actions CI/CD publishing with SLSA attestation — this is a legitimate, security-improving automation change for this package. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Removal of individual maintainers is consistent with MDN BCD's transition to fully automated GitHub Actions publishing; no suspicious new maintainers added. | ai |
Versions (showing 96 of 396)
| Version | Deps | Published |
|---|---|---|
| 5.2.5 | 0 / 0 | |
| 5.2.4 | 0 / 0 | |
| 5.2.3 | 0 / 0 | |
| 5.2.2 | 0 / 0 | |
| 5.2.1 | 0 / 0 | |
| 5.2.0 | 0 / 0 | |
| 5.1.10 | 0 / 0 | |
| 5.1.9 | 0 / 0 | |
| 5.1.8 | 0 / 0 | |
| 5.1.7 | 0 / 0 | |
| 5.1.6 | 0 / 0 | |
| 5.1.5 | 0 / 0 | |
| 5.1.4 | 0 / 0 | |
| 5.1.3 | 0 / 0 | |
| 5.1.2 | 0 / 0 | |
| 5.1.1 | 0 / 0 | |
| 5.1.0 | 0 / 0 | |
| 5.0.3 | 0 / 0 | |
| 5.0.2 | 0 / 0 | |
| 5.0.1 | 0 / 0 | |
| 5.0.0 | 0 / 0 | |
| 4.2.1 | 0 / 0 | |
| 4.2.0 | 0 / 0 | |
| 4.1.20 | 0 / 0 | |
| 4.1.19 | 0 / 0 | |
| 4.1.18 | 0 / 0 | |
| 4.1.17 | 0 / 0 | |
| 4.1.16 | 0 / 0 | |
| 4.1.15 | 0 / 0 | |
| 4.1.14 | 0 / 0 | |
| 4.1.13 | 0 / 0 | |
| 4.1.12 | 0 / 0 | |
| 4.1.11 | 0 / 0 | |
| 4.1.10 | 0 / 0 | |
| 4.1.9 | 0 / 0 | |
| 4.1.8 | 0 / 0 | |
| 4.1.7 | 0 / 0 | |
| 4.1.6 | 0 / 0 | |
| 4.1.5 | 0 / 0 | |
| 4.1.4 | 0 / 0 | |
| 4.1.3 | 0 / 0 | |
| 4.1.2 | 0 / 0 | |
| 4.1.1 | 0 / 0 | |
| 4.1.0 | 0 / 0 | |
| 4.0.12 | 0 / 0 | |
| 4.0.11 | 0 / 0 | |
| 4.0.10 | 0 / 0 | |
| 4.0.9 | 0 / 0 | |
| 4.0.8 | 0 / 0 | |
| 4.0.7 | 0 / 0 | |
| 4.0.6 | 0 / 0 | |
| 4.0.5 | 0 / 0 | |
| 4.0.4 | 0 / 0 | |
| 4.0.3 | 0 / 0 | |
| 4.0.2 | 0 / 0 | |
| 4.0.1 | 0 / 0 | |
| 4.0.0 | 0 / 0 | |
| 3.3.14 | 0 / 0 | |
| 3.3.13 | 0 / 0 | |
| 3.3.12 | 0 / 0 | |
| 3.3.11 | 0 / 0 | |
| 3.3.10 | 0 / 0 | |
| 3.3.9 | 0 / 0 | |
| 3.3.8 | 0 / 0 | |
| 3.3.7 | 0 / 0 | |
| 3.3.6 | 0 / 0 | |
| 3.3.5 | 0 / 0 | |
| 3.3.4 | 0 / 0 | |
| 3.3.3 | 0 / 0 | |
| 3.3.2 | 0 / 0 | |
| 3.3.1 | 0 / 0 | |
| 3.3.0 | 0 / 0 | |
| 3.2.4 | 1 / 9 | |
| 3.2.3 | 1 / 9 | |
| 3.2.2 | 1 / 9 | |
| 3.2.1 | 1 / 9 | |
| 3.2.0 | 1 / 9 | |
| 3.1.3 | 1 / 9 | |
| 3.1.2 | 1 / 9 | |
| 3.1.1 | 1 / 9 | |
| 3.1.0 | 1 / 9 | |
| 3.0.6 | 1 / 9 | |
| 3.0.5 | 1 / 9 | |
| 3.0.4 | 1 / 9 | |
| 3.0.3 | 1 / 9 | |
| 3.0.2 | 1 / 9 | |
| 3.0.1 | 1 / 9 | |
| 3.0.0 | 1 / 9 | |
| 2.0.7 | 1 / 9 | |
| 2.0.6 | 1 / 9 | |
| 2.0.5 | 1 / 9 | |
| 2.0.4 | 1 / 8 | |
| 2.0.3 | 1 / 8 | |
| 2.0.2 | 1 / 8 | |
| 2.0.1 | 1 / 8 | |
| 2.0.0 | 1 / 8 |
v4.1.18
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.16
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.15
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.14
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.13
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.