@rspack/dev-server
Development server for Rspack
27
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
hardfistchenjiahan
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/0~serve-static.js | AI (source-diff): Webpack-bundled dependency output with license headers; not obfuscated. | ai | |
| phantom-deps | phantom-dep:@rspack/dev-middleware | AI (phantom-deps): Same-org dep declared in dependencies; re-exported or used transitively. | ai | |
| phantom-deps | phantom-dep:http-proxy-middleware | AI (phantom-deps): http-proxy-middleware is a declared runtime dep used indirectly through webpack-dev-server. | ai | |
| phantom-deps | phantom-dep:ws | AI (phantom-deps): ws is a declared runtime dependency; phantom-dep fires because it's used indirectly via webpack-dev-server internals. | ai | |
| provenance | publisher-changed | AI (provenance): hardfist is a known rspack org maintainer with extensive track record (2275 approved). Legitimate team member publishing. | ai | |
| dependencies | unvetted-dep:launch-editor | AI (dependencies): launch-editor is a well-known utility used by Vue CLI, webpack-dev-server, and similar tools. Legitimate dependency for a dev server. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Flagged maintainers (hardfist, chenjiahan) are known Bytedance/web-infra-dev contributors to the rspack ecosystem — not spam publishers. | ai | |
| source-diff | net-exec-file:client/modules/sockjs-client/index.js | AI (source-diff): This is a bundled sockjs-client UMD module — a standard client-side transport library. Network calls and dynamic module loading are expected in this context. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase reflects internalizing webpack-dev-server's dependencies rather than delegating to it — a legitimate architectural refactor. | ai | |
| phantom-deps | phantom-dep:@types/bonjour | AI (phantom-deps): TypeScript type declarations; loaded by TS compiler, not runtime imports. | ai | |
| phantom-deps | phantom-dep:spdy | AI (phantom-deps): Conditionally required at runtime for HTTPS/HTTP2 support, same pattern as webpack-dev-server. | ai | |
| phantom-deps | phantom-dep:@types/ws | AI (phantom-deps): TypeScript type declarations; loaded by TS compiler, not runtime imports. | ai | |
| phantom-deps | phantom-dep:@types/sockjs | AI (phantom-deps): TypeScript type declarations; loaded by TS compiler, not runtime imports. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): new Function() is used to deserialize overlay filter functions from URL-encoded strings, a known pattern in webpack/rspack dev server overlay feature. | ai | |
| phantom-deps | phantom-dep:@types/express | AI (phantom-deps): TypeScript type declarations; loaded by TS compiler, not runtime imports. | ai | |
| phantom-deps | phantom-dep:@types/serve-index | AI (phantom-deps): TypeScript type declarations; loaded by TS compiler, not runtime imports. | ai | |
| phantom-deps | phantom-dep:@types/serve-static | AI (phantom-deps): TypeScript type declarations; loaded by TS compiler, not runtime imports. | ai | |
| phantom-deps | phantom-dep:@types/express-serve-static-core | AI (phantom-deps): TypeScript type declarations; loaded by TS compiler, not runtime imports. | ai | |
| phantom-deps | phantom-dep:@types/connect-history-api-fallback | AI (phantom-deps): TypeScript type declarations; loaded by TS compiler, not runtime imports. | ai | |
| phantom-deps | phantom-dep:ansi-html-community | AI (phantom-deps): Used by client overlay module for HTML rendering; referenced indirectly through bundled client code. | ai |
Versions (showing 27 of 127)
| Version | Deps | Published |
|---|---|---|
| 0.0.18 | 9 / 6 | |
| 0.0.17 | 9 / 6 | |
| 0.0.16 | 9 / 6 | |
| 0.0.15 | 9 / 6 | |
| 0.0.14 | 9 / 6 | |
| 0.0.13 | 9 / 6 | |
| 0.0.12 | 9 / 6 | |
| 0.0.11 | 8 / 6 | |
| 0.0.10 | 8 / 6 | |
| 0.0.9 | 8 / 6 | |
| 0.0.8 | 8 / 6 | |
| 0.0.7 | 3 / 3 | |
| 0.0.6 | 3 / 3 | |
| 0.0.4 | 3 / 3 | |
| 0.0.3 | 3 / 3 | |
| 0.0.2 | 3 / 3 | |
| 2.0.0-rc.3 | 1 / 36 | |
| 2.0.0-rc.2 | 1 / 36 | |
| 2.0.0-rc.1 | 5 / 34 | |
| 2.0.0-rc.0 | 7 / 31 | |
| 2.0.0-beta.7 | 9 / 29 | |
| 2.0.0-beta.6 | 9 / 30 | |
| 2.0.0-beta.5 | 11 / 30 | |
| 2.0.0-beta.4 | 13 / 30 | |
| 2.0.0-beta.3 | 13 / 31 | |
| 2.0.0-beta.2 | 12 / 32 | |
| 2.0.0-beta.1 | 17 / 28 |