svelte
Cybernetically enhanced web apps
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:@types/estree | AI (phantom-deps): Type-only package used for TypeScript declarations; not imported at runtime. Standard pattern for TypeScript-aware packages. | ai | |
| phantom-deps | phantom-dep:@types/trusted-types | AI (phantom-deps): Type-only package used for TypeScript declarations; not imported at runtime. Standard pattern for TypeScript-aware packages. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Base64 decode is used in source map utilities (atob/Buffer.from) for legitimate compiler functionality, not payload obfuscation. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Reflect.get() is used in Svelte's reactive proxy implementation — standard JavaScript Proxy trap pattern, not obfuscation. | ai |
Versions (showing 23 of 23)
| Version | Deps | Published |
|---|---|---|
| 5.56.0 | 16 / 17 | |
| 5.55.10 | 16 / 15 | |
| 5.55.9 | 16 / 15 | |
| 5.55.8 | 16 / 15 | |
| 5.55.7 | 16 / 15 | |
| 5.55.6 | 16 / 15 | |
| 5.55.5 | 16 / 15 | |
| 5.55.4 | 16 / 15 | |
| 5.55.3 | 16 / 15 | |
| 5.55.2 | 16 / 15 | |
| 5.55.1 | 16 / 15 | |
| 5.55.0 | 16 / 15 | |
| 5.54.1 | 16 / 15 | |
| 5.54.0 | 16 / 15 | |
| 5.53.13 | 16 / 15 | |
| 5.53.12 | 16 / 15 | |
| 5.53.11 | 16 / 15 | |
| 5.53.10 | 16 / 15 | |
| 5.53.9 | 16 / 15 | |
| 5.53.8 | 16 / 15 | |
| 5.53.7 | 16 / 15 | |
| 5.53.6 | 16 / 15 | |
| 5.53.5 | 16 / 15 |
v5.56.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.55.10
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.55.9
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.55.8
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.55.7
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.55.6
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.55.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.