@stencil/core
A Compiler for Web Components and Progressive Web Apps
82
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
ionicjsgm-osvmfognbmjohnny.jenkinsstencil-bot
Keywords
web componentscomponentsstencilionicwebappcustom elementspwaprogressive web app
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:new-function-constructor | AI (semgrep): Used as a documented Chromium bug workaround for dynamic imports with a hardcoded template string — not user-controlled input. Stable pattern in Stencil's browser runtime. | ai | |
| typosquat | typosquat.levenshtein:cors | AI (typosquat): @stencil/core is a long-established, scoped Ionic package; Levenshtein match against 'cors' is a false positive that will never be a real risk for this package. | ai | |
| semgrep | semgrep:child-process-spawn | AI (semgrep): Spawning child processes is expected for a dev-server/build tool; used for compiler worker and cross-spawn bundled dependency. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require loads the Stencil compiler from a computed but controlled path (devServerDir/../compiler/stencil.js) — standard plugin loading pattern. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Dev-server bundles npm-run-path/cross-spawn which spread process.env to pass env to child processes — standard build tool behavior. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Reflect.get() usage is in bundled node-fetch dependency — standard minified third-party code, not obfuscation. | ai | |
| semgrep | semgrep:env-bulk-read | AI (semgrep): Env enumeration is in bundled third-party code (debug library) within sys/node/index.js — not malicious. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): Stencil dev-server legitimately uses child_process to spawn compiler worker processes — core build tool functionality. | ai |
Versions (showing 82 of 382)
| Version | Deps | Published |
|---|---|---|
| 0.9.5 | 11 / 31 | |
| 0.9.4 | 11 / 31 | |
| 0.9.3 | 11 / 31 | |
| 0.9.2 | 11 / 31 | |
| 0.9.1 | 11 / 31 | |
| 0.9.0 | 11 / 31 | |
| 0.8.2 | 11 / 31 | |
| 0.8.1 | 11 / 31 | |
| 0.8.0 | 11 / 31 | |
| 0.7.26 | 11 / 31 | |
| 0.7.25 | 11 / 31 | |
| 0.7.24 | 11 / 31 | |
| 0.7.23 | 11 / 31 | |
| 0.7.22 | 11 / 31 | |
| 0.7.21 | 11 / 31 | |
| 0.7.20 | 11 / 31 | |
| 0.7.19 | 11 / 28 | |
| 0.7.18 | 11 / 28 | |
| 0.7.17 | 11 / 28 | |
| 0.7.16 | 11 / 28 | |
| 0.7.15 | 11 / 28 | |
| 0.7.14 | 11 / 28 | |
| 0.7.13 | 11 / 28 | |
| 0.7.12 | 11 / 28 | |
| 0.7.11 | 11 / 28 | |
| 0.7.10 | 11 / 28 | |
| 0.7.9 | 11 / 28 | |
| 0.7.8 | 11 / 28 | |
| 0.7.7 | 11 / 28 | |
| 0.7.6 | 11 / 28 | |
| 0.7.5 | 11 / 28 | |
| 0.7.4 | 11 / 28 | |
| 0.7.3 | 11 / 28 | |
| 0.7.2 | 11 / 28 | |
| 0.7.1 | 11 / 28 | |
| 0.7.0 | 11 / 28 | |
| 0.6.18 | 11 / 29 | |
| 0.6.17 | 11 / 29 | |
| 0.6.16 | 11 / 29 | |
| 0.6.15 | 11 / 28 | |
| 0.6.14 | 11 / 28 | |
| 0.6.13 | 11 / 28 | |
| 0.6.12 | 11 / 28 | |
| 0.6.11 | 11 / 28 | |
| 0.6.10 | 11 / 28 | |
| 0.6.9 | 11 / 28 | |
| 0.6.8 | 11 / 28 | |
| 0.6.7 | 11 / 28 | |
| 0.6.6 | 11 / 28 | |
| 0.6.5 | 11 / 28 | |
| 0.6.4 | 11 / 28 | |
| 0.6.3 | 11 / 28 | |
| 0.6.2 | 11 / 28 | |
| 0.6.1 | 10 / 28 | |
| 0.6.0 | 10 / 28 | |
| 0.5.2 | 11 / 28 | |
| 0.5.1 | 11 / 28 | |
| 0.5.0 | 11 / 28 | |
| 0.4.3 | 11 / 28 | |
| 0.4.2 | 11 / 28 | |
| 0.4.1 | 11 / 28 | |
| 0.4.0 | 11 / 28 | |
| 0.3.0 | 11 / 28 | |
| 0.2.3 | 9 / 24 | |
| 0.2.2 | 9 / 24 | |
| 0.2.1 | 9 / 24 | |
| 0.2.0 | 9 / 24 | |
| 0.1.6 | 9 / 27 | |
| 0.1.5 | 9 / 28 | |
| 0.1.4 | 9 / 28 | |
| 0.1.3 | 9 / 28 | |
| 0.1.2 | 9 / 28 | |
| 0.1.1 | 9 / 28 | |
| 0.1.0 | 9 / 0 | |
| 0.0.8 | 9 / 0 | |
| 0.0.7 | 9 / 0 | |
| 0.0.6 | 9 / 0 | |
| 0.0.5 | 9 / 33 | |
| 0.0.4 | 11 / 26 | |
| 0.0.3 | 11 / 26 | |
| 0.0.2 | 11 / 26 | |
| 0.0.1 | 8 / 26 |