docz
It's has never been so easy to documents your things!
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:react-dom | AI (phantom-deps): react-dom is a declared peer/runtime dep used by docz consumers; not directly imported in source but legitimately referenced in config. Stable false positive for this package. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): renatobenks is a recognized contributor to the doczjs org; legitimate maintainer addition. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): @emotion/react replaces @emotion/core — standard Emotion v11 migration, not a new dependency addition. | ai | |
| provenance | publisher-changed | AI (provenance): renatobenks is a known docz maintainer with clean track record (331 approved, 0 rejected). Legitimate maintainer transition. | ai | |
| phantom-deps | phantom-dep:gatsby-plugin-eslint | AI (phantom-deps): Gatsby plugin dependency passed through to user's Gatsby config, not directly imported in docz source. Expected for a Gatsby-based framework. | ai | |
| phantom-deps | phantom-dep:gatsby-plugin-typescript | AI (phantom-deps): Gatsby plugin dependency passed through to user's Gatsby config, not directly imported in docz source. Expected for a Gatsby-based framework. | ai | |
| phantom-deps | phantom-dep:@emotion/core | AI (phantom-deps): Styling dependency used by gatsby-theme-docz, declared for version pinning purposes. Phantom pattern expected for this framework. | ai | |
| phantom-deps | phantom-dep:scheduler | AI (phantom-deps): React ecosystem peer dependency declared for compatibility pinning; not directly imported in docz source. Expected pattern. | ai | |
| phantom-deps | phantom-dep:prop-types | AI (phantom-deps): React ecosystem peer dependency declared for compatibility; not directly imported in docz source. Expected pattern. | ai | |
| phantom-deps | phantom-dep:yargs | AI (phantom-deps): CLI argument parsing dependency referenced in config files; phantom detection is a false positive for this CLI tool. | ai | |
| phantom-deps | phantom-dep:@mdx-js/react | AI (phantom-deps): MDX dependency passed through to user's Gatsby/MDX setup; not directly imported in docz source. Expected for this framework. | ai | |
| phantom-deps | phantom-dep:gatsby-theme-docz | AI (phantom-deps): docz is a Gatsby-based framework; deps like gatsby-theme-docz are passed through to user projects, not directly imported in docz source. Expected pattern. | ai |
Versions (showing 92 of 92)
| Version | Deps | Published |
|---|---|---|
| 2.4.0 | 18 / 0 | |
| 2.3.1 | 18 / 10 | |
| 2.3.0 | 18 / 10 | |
| 2.2.0 | 17 / 9 | |
| 2.1.1 | 17 / 9 | |
| 2.1.0 | 17 / 9 | |
| 2.0.0 | 17 / 9 | |
| 1.3.2 | 14 / 7 | |
| 1.3.1 | 14 / 7 | |
| 1.3.0 | 14 / 7 | |
| 1.2.0 | 14 / 7 | |
| 1.1.0 | 14 / 7 | |
| 1.0.4 | 14 / 6 | |
| 1.0.3 | 14 / 6 | |
| 1.0.2 | 14 / 6 | |
| 1.0.1 | 14 / 6 | |
| 1.0.0 | 14 / 12 | |
| 0.13.7 | 19 / 0 | |
| 0.13.6 | 19 / 0 | |
| 0.13.5 | 19 / 0 | |
| 0.13.4 | 19 / 0 | |
| 0.13.3 | 19 / 0 | |
| 0.13.2 | 19 / 0 | |
| 0.13.1 | 19 / 0 | |
| 0.13.0 | 19 / 0 | |
| 0.12.17 | 19 / 6 | |
| 0.12.16 | 20 / 6 | |
| 0.12.15 | 20 / 5 | |
| 0.12.14 | 20 / 5 | |
| 0.12.13 | 20 / 5 | |
| 0.12.12 | 20 / 5 | |
| 0.12.11 | 20 / 5 | |
| 0.12.10 | 20 / 5 | |
| 0.12.9 | 19 / 5 | |
| 0.12.8 | 19 / 5 | |
| 0.12.7 | 19 / 6 | |
| 0.12.6 | 19 / 6 | |
| 0.12.5 | 19 / 6 | |
| 0.12.4 | 19 / 6 | |
| 0.12.3 | 19 / 6 | |
| 0.12.2 | 19 / 6 | |
| 0.11.2 | 17 / 5 | |
| 0.11.1 | 17 / 5 | |
| 0.11.0 | 17 / 5 | |
| 0.10.3 | 17 / 5 | |
| 0.10.2 | 17 / 5 | |
| 0.10.1 | 17 / 5 | |
| 0.10.0 | 17 / 5 | |
| 0.9.6 | 17 / 5 | |
| 0.9.5 | 17 / 5 | |
| 0.9.4 | 17 / 5 | |
| 0.9.3 | 17 / 5 | |
| 0.9.2 | 17 / 5 | |
| 0.9.1 | 17 / 5 | |
| 0.9.0 | 17 / 5 | |
| 0.8.0 | 18 / 5 | |
| 0.7.1 | 18 / 5 | |
| 0.7.0 | 17 / 5 | |
| 0.6.2 | 15 / 5 | |
| 0.6.1 | 14 / 5 | |
| 0.6.0 | 14 / 5 | |
| 0.5.9 | 14 / 5 | |
| 0.5.8 | 14 / 5 | |
| 0.5.7 | 14 / 5 | |
| 0.5.6 | 14 / 5 | |
| 0.5.5 | 14 / 5 | |
| 0.5.4 | 14 / 5 | |
| 0.5.3 | 14 / 5 | |
| 0.5.2 | 14 / 5 | |
| 0.5.1 | 13 / 5 | |
| 0.5.0 | 13 / 5 | |
| 0.4.0 | 12 / 5 | |
| 0.3.4 | 12 / 5 | |
| 0.3.3 | 11 / 5 | |
| 0.3.2 | 11 / 5 | |
| 0.3.1 | 11 / 5 | |
| 0.3.0 | 12 / 5 | |
| 0.2.11 | 12 / 5 | |
| 0.2.10 | 12 / 5 | |
| 0.2.9 | 12 / 5 | |
| 0.2.8 | 12 / 5 | |
| 0.2.7 | 11 / 5 | |
| 0.2.6 | 11 / 5 | |
| 0.2.5 | 11 / 5 | |
| 0.2.4 | 11 / 5 | |
| 0.2.3 | 11 / 5 | |
| 0.2.2 | 11 / 5 | |
| 0.2.1 | 11 / 5 | |
| 0.2.0 | 11 / 5 | |
| 0.1.1 | 11 / 5 | |
| 0.1.0 | 9 / 5 | |
| 0.0.1 | 0 / 0 |
v2.4.0
2 findingsThis version was published by a different npm account than previous versions on 2022-02-11. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.3.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.3.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.2.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: rakannimer.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.1
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: rakannimer.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2019-09-03. This could indicate a legitimate maintainer transition or an account compromise.
v1.3.0
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: rakannimer.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2019-09-02. This could indicate a legitimate maintainer transition or an account compromise.
v1.2.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.