ava
Node.js test runner that lets you develop with confidence.
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): New deps (@vercel/nft, memoize, package-config) are legitimate replacements for removed deps (mem, pkg-conf, etc.) in a major version bump by a trusted publisher with 295 approved packages. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Mature test runner with infrequent major releases; 230-day gap between v6 and v7 is normal. | ai | |
| provenance | publisher-changed | AI (provenance): Transition from individual maintainer to GitHub Actions CI/CD publishing with SLSA provenance attestation. Standard for mature projects. | ai | |
| dependencies | unvetted-peer-dep:@ava/typescript | AI (dependencies): Optional peer dependency for TypeScript support; runs in consumer's environment as intended. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require() in worker/base.js is intentional test framework behavior for loading user test files, explicitly documented in source comments. | ai | |
| dependencies | unvetted-dep:figures | AI (dependencies): figures is a well-known sindresorhus terminal symbols utility; its use in AVA's output formatting is expected and benign. | ai | |
| phantom-deps | phantom-dep:resolve-cwd | AI (phantom-deps): resolve-cwd is explicitly listed as a direct dependency in package.json; phantom-dep detection appears to be a false positive. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): AVA intentionally spreads process.env into worker threads so tests run in the correct environment. This is core test runner functionality, not a secret leak. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Reflect.get() is used in like-selector.js for legitimate property inspection in AVA's t.like() assertion implementation. Not obfuscation. | ai |
Versions (showing 98 of 98)
| Version | Deps | Published |
|---|---|---|
| 8.0.1 | 40 / 15 | |
| 8.0.0 | 40 / 15 | |
| 7.0.0 | 39 / 15 | |
| 6.4.1 | 40 / 15 | |
| 6.3.0 | 40 / 15 | |
| 6.2.0 | 40 / 15 | |
| 6.1.2 | 40 / 15 | |
| 6.0.1 | 40 / 15 | |
| 6.0.0 | 40 / 15 | |
| 5.3.1 | 43 / 20 | |
| 5.3.0 | 43 / 20 | |
| 5.2.0 | 45 / 19 | |
| 5.1.1 | 45 / 19 | |
| 5.1.0 | 45 / 20 | |
| 5.0.1 | 45 / 20 | |
| 5.0.0 | 45 / 20 | |
| 4.3.3 | 45 / 19 | |
| 4.3.2 | 45 / 19 | |
| 4.3.1 | 45 / 19 | |
| 4.3.0 | 45 / 19 | |
| 4.2.0 | 45 / 19 | |
| 4.1.0 | 45 / 19 | |
| 4.0.1 | 45 / 19 | |
| 4.0.0 | 45 / 19 | |
| 3.15.0 | 56 / 26 | |
| 3.14.0 | 56 / 25 | |
| 3.13.0 | 56 / 25 | |
| 3.12.1 | 55 / 25 | |
| 3.12.0 | 55 / 25 | |
| 3.11.1 | 55 / 25 | |
| 3.11.0 | 55 / 25 | |
| 3.10.1 | 55 / 25 | |
| 3.10.0 | 55 / 25 | |
| 3.9.0 | 55 / 25 | |
| 3.8.2 | 55 / 25 | |
| 3.8.1 | 55 / 24 | |
| 3.8.0 | 55 / 24 | |
| 3.7.1 | 53 / 23 | |
| 3.7.0 | 53 / 23 | |
| 3.6.0 | 52 / 23 | |
| 3.5.2 | 52 / 25 | |
| 3.5.1 | 52 / 22 | |
| 3.5.0 | 52 / 22 | |
| 3.4.0 | 52 / 22 | |
| 3.3.0 | 52 / 23 | |
| 3.2.0 | 52 / 23 | |
| 3.1.0 | 52 / 23 | |
| 3.0.0 | 52 / 23 | |
| 2.4.0 | 73 / 22 | |
| 2.3.0 | 73 / 23 | |
| 2.2.0 | 76 / 23 | |
| 2.1.0 | 76 / 23 | |
| 2.0.0 | 76 / 23 | |
| 1.4.1 | 81 / 24 | |
| 1.4.0 | 81 / 24 | |
| 1.3.1 | 81 / 24 | |
| 1.3.0 | 81 / 24 | |
| 1.2.1 | 81 / 24 | |
| 1.2.0 | 81 / 24 | |
| 1.1.0 | 81 / 24 | |
| 1.0.1 | 81 / 24 | |
| 0.25.0 | 83 / 27 | |
| 0.24.0 | 83 / 26 | |
| 0.23.0 | 80 / 25 | |
| 0.22.0 | 80 / 25 | |
| 0.21.0 | 80 / 25 | |
| 0.20.0 | 79 / 25 | |
| 0.19.1 | 78 / 24 | |
| 0.19.0 | 78 / 23 | |
| 0.18.2 | 73 / 25 | |
| 0.18.1 | 73 / 24 | |
| 0.18.0 | 73 / 24 | |
| 0.17.0 | 75 / 23 | |
| 0.16.0 | 71 / 23 | |
| 0.15.2 | 72 / 21 | |
| 0.15.1 | 71 / 21 | |
| 0.15.0 | 71 / 21 | |
| 0.14.0 | 65 / 19 | |
| 0.13.0 | 60 / 19 | |
| 0.12.0 | 54 / 19 | |
| 0.11.0 | 51 / 13 | |
| 0.10.0 | 50 / 13 | |
| 0.9.2 | 44 / 9 | |
| 0.9.1 | 43 / 9 | |
| 0.9.0 | 43 / 8 | |
| 0.8.0 | 38 / 7 | |
| 0.7.0 | 36 / 6 | |
| 0.6.1 | 33 / 5 | |
| 0.6.0 | 33 / 5 | |
| 0.5.0 | 28 / 7 | |
| 0.4.2 | 26 / 6 | |
| 0.4.1 | 26 / 6 | |
| 0.4.0 | 26 / 6 | |
| 0.3.0 | 23 / 5 | |
| 0.2.0 | 14 / 3 | |
| 0.1.0 | 11 / 4 | |
| 0.0.4 | 4 / 1 | |
| 0.0.3 | 2 / 1 |
v8.0.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v8.0.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v7.0.0
4 findingsThis version was published by a different npm account than previous versions on 2026-02-27. This could indicate a legitimate maintainer transition or an account compromise.
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/avajs/ava/blob/7c1b3a7a965548c25c1023afc42586f34ec8e5d9/lib/fork.js#L25 23 | worker = new Worker(workerPath, { 24 | argv: options.workerArgv, > 25 | env: {NODE_ENV: 'test', ...process.env, ...options.environmentVariables}, 26 | execArgv: [...execArgv, ...additionalExecArgv], 27 | workerData: {
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/avajs/ava/blob/7c1b3a7a965548c25c1023afc42586f34ec8e5d9/lib/fork.js#L48 46 | cwd: options.projectDir, 47 | silent: true, > 48 | env: {NODE_ENV: 'test', ...process.env, ...options.environmentVariables}, 49 | execArgv: [...execArgv, ...additionalExecArgv], 50 | serialization: 'advanced',
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.4.1
3 findingsSpreading entire process.env into an object — may capture all secrets Source: https://github.com/avajs/ava/blob/603d7ca2ada70f3e9e79ee5002a509f0646cb37c/lib/fork.js#L25 23 | worker = new Worker(workerPath, { 24 | argv: options.workerArgv, > 25 | env: {NODE_ENV: 'test', ...process.env, ...options.environmentVariables}, 26 | execArgv: [...execArgv, ...additionalExecArgv], 27 | workerData: {
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/avajs/ava/blob/603d7ca2ada70f3e9e79ee5002a509f0646cb37c/lib/fork.js#L48 46 | cwd: options.projectDir, 47 | silent: true, > 48 | env: {NODE_ENV: 'test', ...process.env, ...options.environmentVariables}, 49 | execArgv: [...execArgv, ...additionalExecArgv], 50 | serialization: 'advanced',
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.3.0
3 findingsSpreading entire process.env into an object — may capture all secrets Source: https://github.com/avajs/ava/blob/ca4240db7f81f67a540f9e20c4c1375110dbe598/lib/fork.js#L25 23 | worker = new Worker(workerPath, { 24 | argv: options.workerArgv, > 25 | env: {NODE_ENV: 'test', ...process.env, ...options.environmentVariables}, 26 | execArgv: [...execArgv, ...additionalExecArgv], 27 | workerData: {
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/avajs/ava/blob/ca4240db7f81f67a540f9e20c4c1375110dbe598/lib/fork.js#L48 46 | cwd: options.projectDir, 47 | silent: true, > 48 | env: {NODE_ENV: 'test', ...process.env, ...options.environmentVariables}, 49 | execArgv: [...execArgv, ...additionalExecArgv], 50 | serialization: 'advanced',
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.2.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.1.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.0.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.