Every third-party and first-party component compiled or bundled into the products SigmaShake ships — generated directly from committed lockfiles, in CycloneDX 1.6 format.
A Software Bill of Materials (SBOM) is a complete inventory of the components that make up a piece of software. SigmaShake publishes one for every product it ships so that customers, auditors, and procurement teams can see exactly what third-party code they would be running — no scanners, no NDA, no estimates.
This inventory is generated mechanically from committed lockfiles (bun.lock, Cargo.lock, mix.lock) and emitted in the industry-standard CycloneDX 1.6 format. It is regenerated on every release, so it never drifts from the code that actually ships.
@sigmashake/ssg@0.29.156
Third-party and first-party code compiled or bundled into the artifact a customer installs and runs.
| Component | Version | Ecosystem | Origin | License |
|---|---|---|---|---|
| react | 19.2.4 | npm | third-party | MIT |
| react-dom | 19.2.4 | npm | third-party | MIT |
| scheduler | 0.27.0 | npm | third-party | MIT |
| ssg_parser | 0.29.62 | cargo | first-party | SigmaShake Proprietary |
| ssg-eval-server | 0.1.0 | cargo | first-party | SigmaShake Proprietary |
| @sigmashake/ssg-darwin-arm64 | 0.29.155 | npm | first-party | SigmaShake Proprietary |
| @sigmashake/ssg-darwin-x64 | 0.29.155 | npm | first-party | SigmaShake Proprietary |
| @sigmashake/ssg-linux-arm64 | 0.29.155 | npm | first-party | SigmaShake Proprietary |
| @sigmashake/ssg-linux-x64 | 0.29.155 | npm | first-party | SigmaShake Proprietary |
| @sigmashake/ssg-win32-x64 | 0.29.155 | npm | first-party | SigmaShake Proprietary |
| Component | Version | Ecosystem | Origin | License |
|---|---|---|---|---|
| @babel/code-frame | 7.29.0 | npm | third-party | MIT |
| @babel/helper-validator-identifier | 7.28.5 | npm | third-party | MIT |
| @emnapi/core | 1.10.0 | npm | third-party | — |
| @emnapi/core | 1.9.2 | npm | third-party | — |
| @emnapi/runtime | 1.10.0 | npm | third-party | — |
| @emnapi/runtime | 1.9.2 | npm | third-party | — |
| @emnapi/wasi-threads | 1.2.1 | npm | third-party | — |
| @eslint-community/eslint-utils | 4.9.1 | npm | third-party | MIT |
| @eslint-community/regexpp | 4.12.2 | npm | third-party | MIT |
| @eslint/config-array | 0.21.2 | npm | third-party | Apache-2.0 |
| @eslint/config-array | 0.23.3 | npm | third-party | Apache-2.0 |
| @eslint/config-helpers | 0.4.2 | npm | third-party | Apache-2.0 |
| @eslint/config-helpers | 0.5.3 | npm | third-party | Apache-2.0 |
| @eslint/core | 0.17.0 | npm | third-party | Apache-2.0 |
| @eslint/core | 1.1.1 | npm | third-party | Apache-2.0 |
| @eslint/eslintrc | 3.3.5 | npm | third-party | MIT |
| @eslint/js | 9.39.4 | npm | third-party | MIT |
| @eslint/object-schema | 2.1.7 | npm | third-party | Apache-2.0 |
| @eslint/object-schema | 3.0.3 | npm | third-party | Apache-2.0 |
| @eslint/plugin-kit | 0.4.1 | npm | third-party | Apache-2.0 |
| @eslint/plugin-kit | 0.6.1 | npm | third-party | Apache-2.0 |
| @humanfs/core | 0.19.1 | npm | third-party | Apache-2.0 |
| @humanfs/node | 0.16.7 | npm | third-party | Apache-2.0 |
| @humanwhocodes/module-importer | 1.0.1 | npm | third-party | Apache-2.0 |
| @humanwhocodes/retry | 0.4.3 | npm | third-party | Apache-2.0 |
| @javascript-obfuscator/escodegen | 2.3.0 | npm | third-party | BSD-2-Clause |
| @javascript-obfuscator/estraverse | 5.4.0 | npm | third-party | BSD-2-Clause |
| @jridgewell/gen-mapping | 0.3.13 | npm | third-party | MIT |
| @jridgewell/remapping | 2.3.5 | npm | third-party | MIT |
| @jridgewell/resolve-uri | 3.1.2 | npm | third-party | MIT |
| @jridgewell/source-map | 0.3.11 | npm | third-party | MIT |
| @jridgewell/sourcemap-codec | 1.5.5 | npm | third-party | MIT |
| @jridgewell/trace-mapping | 0.3.31 | npm | third-party | MIT |
| @napi-rs/wasm-runtime | 1.1.2 | npm | third-party | — |
| @napi-rs/wasm-runtime | 1.1.4 | npm | third-party | — |
| @oxc-project/types | 0.130.0 | npm | third-party | MIT |
| @pkgr/core | 0.2.9 | npm | third-party | MIT |
| @rolldown/binding-android-arm64 | 1.0.1 | npm | third-party | — |
| @rolldown/binding-darwin-arm64 | 1.0.1 | npm | third-party | — |
| @rolldown/binding-darwin-x64 | 1.0.1 | npm | third-party | — |
| @rolldown/binding-freebsd-x64 | 1.0.1 | npm | third-party | — |
| @rolldown/binding-linux-arm-gnueabihf | 1.0.1 | npm | third-party | — |
| @rolldown/binding-linux-arm64-gnu | 1.0.1 | npm | third-party | — |
| @rolldown/binding-linux-arm64-musl | 1.0.1 | npm | third-party | — |
| @rolldown/binding-linux-ppc64-gnu | 1.0.1 | npm | third-party | — |
| @rolldown/binding-linux-s390x-gnu | 1.0.1 | npm | third-party | — |
| @rolldown/binding-linux-x64-gnu | 1.0.1 | npm | third-party | MIT |
| @rolldown/binding-linux-x64-musl | 1.0.1 | npm | third-party | MIT |
| @rolldown/binding-openharmony-arm64 | 1.0.1 | npm | third-party | — |
| @rolldown/binding-wasm32-wasi | 1.0.1 | npm | third-party | — |
| @rolldown/binding-win32-arm64-msvc | 1.0.1 | npm | third-party | — |
| @rolldown/binding-win32-x64-msvc | 1.0.1 | npm | third-party | — |
| @rolldown/pluginutils | 1.0.0-rc.7 | npm | third-party | MIT |
| @rolldown/pluginutils | 1.0.1 | npm | third-party | MIT |
| @tailwindcss/node | 4.2.2 | npm | third-party | MIT |
| @tailwindcss/oxide | 4.2.2 | npm | third-party | MIT |
| @tailwindcss/oxide-android-arm64 | 4.2.2 | npm | third-party | — |
| @tailwindcss/oxide-darwin-arm64 | 4.2.2 | npm | third-party | — |
| @tailwindcss/oxide-darwin-x64 | 4.2.2 | npm | third-party | — |
| @tailwindcss/oxide-freebsd-x64 | 4.2.2 | npm | third-party | — |
| @tailwindcss/oxide-linux-arm-gnueabihf | 4.2.2 | npm | third-party | — |
| @tailwindcss/oxide-linux-arm64-gnu | 4.2.2 | npm | third-party | — |
| @tailwindcss/oxide-linux-arm64-musl | 4.2.2 | npm | third-party | — |
| @tailwindcss/oxide-linux-x64-gnu | 4.2.2 | npm | third-party | MIT |
| @tailwindcss/oxide-linux-x64-musl | 4.2.2 | npm | third-party | MIT |
| @tailwindcss/oxide-wasm32-wasi | 4.2.2 | npm | third-party | — |
| @tailwindcss/oxide-win32-arm64-msvc | 4.2.2 | npm | third-party | — |
| @tailwindcss/oxide-win32-x64-msvc | 4.2.2 | npm | third-party | — |
| @tailwindcss/vite | 4.2.2 | npm | third-party | MIT |
| @tybys/wasm-util | 0.10.1 | npm | third-party | — |
| @types/esrecurse | 4.3.1 | npm | third-party | MIT |
| @types/estree | 1.0.8 | npm | third-party | MIT |
| @types/json-schema | 7.0.15 | npm | third-party | MIT |
| @types/minimatch | 3.0.5 | npm | third-party | MIT |
| @types/minimist | 1.2.5 | npm | third-party | MIT |
| @types/node | 25.5.0 | npm | third-party | MIT |
| @types/node | 25.5.2 | npm | third-party | MIT |
| @types/normalize-package-data | 2.4.4 | npm | third-party | MIT |
| @types/react | 19.2.14 | npm | third-party | MIT |
| @types/react-dom | 19.2.3 | npm | third-party | MIT |
| @types/validator | 13.15.10 | npm | third-party | MIT |
| @typescript-eslint/eslint-plugin | 8.58.0 | npm | third-party | MIT |
| @typescript-eslint/parser | 8.58.0 | npm | third-party | MIT |
| @typescript-eslint/project-service | 8.58.0 | npm | third-party | MIT |
| @typescript-eslint/scope-manager | 8.58.0 | npm | third-party | MIT |
| @typescript-eslint/tsconfig-utils | 8.58.0 | npm | third-party | MIT |
| @typescript-eslint/type-utils | 8.58.0 | npm | third-party | MIT |
| @typescript-eslint/types | 8.58.0 | npm | third-party | MIT |
| @typescript-eslint/typescript-estree | 8.58.0 | npm | third-party | MIT |
| @typescript-eslint/utils | 8.58.0 | npm | third-party | MIT |
| @typescript-eslint/visitor-keys | 8.58.0 | npm | third-party | MIT |
| @vitejs/plugin-react | 6.0.1 | npm | third-party | MIT |
| acorn | 8.16.0 | npm | third-party | MIT |
| acorn | 8.8.2 | npm | third-party | MIT |
| acorn-jsx | 5.3.2 | npm | third-party | MIT |
| ajv | 6.14.0 | npm | third-party | MIT |
| ansi-escapes | 4.3.2 | npm | third-party | MIT |
| ansi-regex | 5.0.1 | npm | third-party | MIT |
| ansi-styles | 4.3.0 | npm | third-party | MIT |
| argparse | 2.0.1 | npm | third-party | Python-2.0 |
| array-differ | 3.0.0 | npm | third-party | MIT |
| array-union | 2.1.0 | npm | third-party | MIT |
| arrify | 1.0.1 | npm | third-party | MIT |
| arrify | 2.0.1 | npm | third-party | MIT |
| assert | 2.0.0 | npm | third-party | MIT |
| available-typed-arrays | 1.0.7 | npm | third-party | MIT |
| balanced-match | 4.0.4 | npm | third-party | MIT |
| brace-expansion | 5.0.6 | npm | third-party | MIT |
| buffer-from | 1.1.2 | npm | third-party | MIT |
| bun-types | 1.3.11 | npm | third-party | MIT |
| call-bind | 1.0.9 | npm | third-party | MIT |
| call-bind-apply-helpers | 1.0.2 | npm | third-party | MIT |
| call-bound | 1.0.4 | npm | third-party | MIT |
| callsites | 3.1.0 | npm | third-party | MIT |
| camelcase | 5.3.1 | npm | third-party | MIT |
| camelcase-keys | 6.2.2 | npm | third-party | MIT |
| chalk | 4.1.2 | npm | third-party | MIT |
| chance | 1.1.9 | npm | third-party | MIT |
| char-regex | 1.0.2 | npm | third-party | MIT |
| chardet | 0.7.0 | npm | third-party | MIT |
| charenc | 0.0.2 | npm | third-party | BSD-3-Clause |
| class-validator | 0.14.1 | npm | third-party | MIT |
| cli-cursor | 3.1.0 | npm | third-party | MIT |
| cli-width | 3.0.0 | npm | third-party | ISC |
| color-convert | 2.0.1 | npm | third-party | MIT |
| color-name | 1.1.4 | npm | third-party | MIT |
| commander | 10.0.0 | npm | third-party | MIT |
| commander | 2.20.3 | npm | third-party | MIT |
| cross-spawn | 7.0.6 | npm | third-party | MIT |
| crypt | 0.0.2 | npm | third-party | BSD-3-Clause |
| csstype | 3.2.3 | npm | third-party | MIT |
| debug | 4.4.3 | npm | third-party | MIT |
| decamelize | 1.2.0 | npm | third-party | MIT |
| decamelize-keys | 1.1.1 | npm | third-party | MIT |
| deep-is | 0.1.4 | npm | third-party | MIT |
| define-data-property | 1.1.4 | npm | third-party | MIT |
| define-properties | 1.2.1 | npm | third-party | MIT |
| detect-libc | 2.1.2 | npm | third-party | Apache-2.0 |
| dunder-proto | 1.0.1 | npm | third-party | MIT |
| emoji-regex | 8.0.0 | npm | third-party | MIT |
| enhanced-resolve | 5.20.1 | npm | third-party | MIT |
| error-ex | 1.3.4 | npm | third-party | MIT |
| es-define-property | 1.0.1 | npm | third-party | MIT |
| es-errors | 1.3.0 | npm | third-party | MIT |
| es-object-atoms | 1.1.1 | npm | third-party | MIT |
| es6-object-assign | 1.1.0 | npm | third-party | MIT |
| escape-string-regexp | 1.0.5 | npm | third-party | MIT |
| escape-string-regexp | 4.0.0 | npm | third-party | MIT |
| eslint | 10.1.0 | npm | third-party | MIT |
| eslint | 9.39.4 | npm | third-party | MIT |
| eslint-compat-utils | 0.5.1 | npm | third-party | MIT |
| eslint-config-prettier | 10.1.8 | npm | third-party | MIT |
| eslint-plugin-es | 3.0.1 | npm | third-party | MIT |
| eslint-plugin-es-x | 7.8.0 | npm | third-party | MIT |
| eslint-plugin-n | 17.24.0 | npm | third-party | MIT |
| eslint-plugin-node | 11.1.0 | npm | third-party | MIT |
| eslint-plugin-prettier | 5.5.5 | npm | third-party | MIT |
| eslint-scope | 7.1.1 | npm | third-party | BSD-2-Clause |
| eslint-scope | 8.4.0 | npm | third-party | BSD-2-Clause |
| eslint-scope | 9.1.2 | npm | third-party | BSD-2-Clause |
| eslint-utils | 2.1.0 | npm | third-party | MIT |
| eslint-visitor-keys | 1.3.0 | npm | third-party | Apache-2.0 |
| eslint-visitor-keys | 3.3.0 | npm | third-party | Apache-2.0 |
| eslint-visitor-keys | 3.4.3 | npm | third-party | Apache-2.0 |
| eslint-visitor-keys | 4.2.1 | npm | third-party | Apache-2.0 |
| eslint-visitor-keys | 5.0.1 | npm | third-party | Apache-2.0 |
| espree | 10.4.0 | npm | third-party | BSD-2-Clause |
| espree | 11.2.0 | npm | third-party | BSD-2-Clause |
| esprima | 4.0.1 | npm | third-party | BSD-2-Clause |
| esquery | 1.7.0 | npm | third-party | BSD-3-Clause |
| esrecurse | 4.3.0 | npm | third-party | BSD-2-Clause |
| estraverse | 5.3.0 | npm | third-party | BSD-2-Clause |
| esutils | 2.0.3 | npm | third-party | BSD-2-Clause |
| execa | 5.1.1 | npm | third-party | MIT |
| external-editor | 3.1.0 | npm | third-party | MIT |
| fast-deep-equal | 3.1.3 | npm | third-party | MIT |
| fast-diff | 1.3.0 | npm | third-party | Apache-2.0 |
| fast-json-stable-stringify | 2.1.0 | npm | third-party | MIT |
| fast-levenshtein | 2.0.6 | npm | third-party | MIT |
| fdir | 6.5.0 | npm | third-party | MIT |
| figures | 3.2.0 | npm | third-party | MIT |
| file-entry-cache | 8.0.0 | npm | third-party | MIT |
| find-up | 4.1.0 | npm | third-party | MIT |
| find-up | 5.0.0 | npm | third-party | MIT |
| flat-cache | 4.0.1 | npm | third-party | MIT |
| flatted | 3.4.2 | npm | third-party | ISC |
| for-each | 0.3.5 | npm | third-party | MIT |
| fsevents | 2.3.3 | npm | third-party | — |
| function-bind | 1.1.2 | npm | third-party | MIT |
| generator-function | 2.0.1 | npm | third-party | MIT |
| get-intrinsic | 1.3.0 | npm | third-party | MIT |
| get-proto | 1.0.1 | npm | third-party | MIT |
| get-stream | 6.0.1 | npm | third-party | MIT |
| get-tsconfig | 4.13.7 | npm | third-party | MIT |
| glob-parent | 6.0.2 | npm | third-party | ISC |
| globals | 14.0.0 | npm | third-party | MIT |
| globals | 15.15.0 | npm | third-party | MIT |
| globrex | 0.1.2 | npm | third-party | MIT |
| gopd | 1.2.0 | npm | third-party | MIT |
| graceful-fs | 4.2.11 | npm | third-party | ISC |
| gts | 7.0.0 | npm | third-party | Apache-2.0 |
| hard-rejection | 2.1.0 | npm | third-party | MIT |
| has-flag | 4.0.0 | npm | third-party | MIT |
| has-property-descriptors | 1.0.2 | npm | third-party | MIT |
| has-symbols | 1.1.0 | npm | third-party | MIT |
| has-tostringtag | 1.0.2 | npm | third-party | MIT |
| hasown | 2.0.2 | npm | third-party | MIT |
| hosted-git-info | 2.8.9 | npm | third-party | ISC |
| hosted-git-info | 4.1.0 | npm | third-party | ISC |
| human-signals | 2.1.0 | npm | third-party | Apache-2.0 |
| iconv-lite | 0.4.24 | npm | third-party | MIT |
| ignore | 5.3.2 | npm | third-party | MIT |
| ignore | 7.0.5 | npm | third-party | MIT |
| import-fresh | 3.3.1 | npm | third-party | MIT |
| imurmurhash | 0.1.4 | npm | third-party | MIT |
| indent-string | 4.0.0 | npm | third-party | MIT |
| inherits | 2.0.4 | npm | third-party | ISC |
| inquirer | 7.3.3 | npm | third-party | MIT |
| inversify | 6.0.1 | npm | third-party | MIT |
| is-arguments | 1.2.0 | npm | third-party | MIT |
| is-arrayish | 0.2.1 | npm | third-party | MIT |
| is-buffer | 1.1.6 | npm | third-party | MIT |
| is-callable | 1.2.7 | npm | third-party | MIT |
| is-core-module | 2.16.1 | npm | third-party | MIT |
| is-extglob | 2.1.1 | npm | third-party | MIT |
| is-fullwidth-code-point | 3.0.0 | npm | third-party | MIT |
| is-generator-function | 1.1.2 | npm | third-party | MIT |
| is-glob | 4.0.3 | npm | third-party | MIT |
| is-nan | 1.3.2 | npm | third-party | MIT |
| is-plain-obj | 1.1.0 | npm | third-party | MIT |
| is-regex | 1.2.1 | npm | third-party | MIT |
| is-stream | 2.0.1 | npm | third-party | MIT |
| is-typed-array | 1.1.15 | npm | third-party | MIT |
| isexe | 2.0.0 | npm | third-party | ISC |
| javascript-obfuscator | 4.1.1 | npm | third-party | BSD-2-Clause |
| jiti | 2.6.1 | npm | third-party | MIT |
| js-string-escape | 1.0.1 | npm | third-party | MIT |
| js-tokens | 4.0.0 | npm | third-party | MIT |
| js-yaml | 4.1.1 | npm | third-party | MIT |
| json-buffer | 3.0.1 | npm | third-party | MIT |
| json-parse-even-better-errors | 2.3.1 | npm | third-party | MIT |
| json-schema-traverse | 0.4.1 | npm | third-party | MIT |
| json-stable-stringify-without-jsonify | 1.0.1 | npm | third-party | MIT |
| json5 | 2.2.3 | npm | third-party | MIT |
| keyv | 4.5.4 | npm | third-party | MIT |
| kind-of | 6.0.3 | npm | third-party | MIT |
| levn | 0.3.0 | npm | third-party | MIT |
| levn | 0.4.1 | npm | third-party | MIT |
| libphonenumber-js | 1.12.41 | npm | third-party | MIT |
| lightningcss | 1.32.0 | npm | third-party | MPL-2.0 |
| lightningcss-android-arm64 | 1.32.0 | npm | third-party | — |
| lightningcss-darwin-arm64 | 1.32.0 | npm | third-party | — |
| lightningcss-darwin-x64 | 1.32.0 | npm | third-party | — |
| lightningcss-freebsd-x64 | 1.32.0 | npm | third-party | — |
| lightningcss-linux-arm-gnueabihf | 1.32.0 | npm | third-party | — |
| lightningcss-linux-arm64-gnu | 1.32.0 | npm | third-party | — |
| lightningcss-linux-arm64-musl | 1.32.0 | npm | third-party | — |
| lightningcss-linux-x64-gnu | 1.32.0 | npm | third-party | MPL-2.0 |
| lightningcss-linux-x64-musl | 1.32.0 | npm | third-party | MPL-2.0 |
| lightningcss-win32-arm64-msvc | 1.32.0 | npm | third-party | — |
| lightningcss-win32-x64-msvc | 1.32.0 | npm | third-party | — |
| lines-and-columns | 1.2.4 | npm | third-party | MIT |
| locate-path | 5.0.0 | npm | third-party | MIT |
| locate-path | 6.0.0 | npm | third-party | MIT |
| lodash | 4.18.1 | npm | third-party | MIT |
| lodash.merge | 4.6.2 | npm | third-party | MIT |
| lru-cache | 6.0.0 | npm | third-party | ISC |
| magic-string | 0.30.21 | npm | third-party | MIT |
| map-obj | 1.0.1 | npm | third-party | MIT |
| map-obj | 4.3.0 | npm | third-party | MIT |
| math-intrinsics | 1.1.0 | npm | third-party | MIT |
| md5 | 2.3.0 | npm | third-party | BSD-3-Clause |
| meow | 9.0.0 | npm | third-party | MIT |
| merge-stream | 2.0.0 | npm | third-party | MIT |
| mimic-fn | 2.1.0 | npm | third-party | MIT |
| min-indent | 1.0.1 | npm | third-party | MIT |
| minimatch | 10.2.5 | npm | third-party | BlueOak-1.0.0 |
| minimatch | 3.1.5 | npm | third-party | BlueOak-1.0.0 |
| minimist-options | 4.1.0 | npm | third-party | MIT |
| mkdirp | 2.1.3 | npm | third-party | MIT |
| ms | 2.1.3 | npm | third-party | MIT |
| multimatch | 5.0.0 | npm | third-party | MIT |
| mute-stream | 0.0.8 | npm | third-party | ISC |
| nanoid | 3.3.11 | npm | third-party | MIT |
| natural-compare | 1.4.0 | npm | third-party | MIT |
| ncp | 2.0.0 | npm | third-party | MIT |
| normalize-package-data | 2.5.0 | npm | third-party | BSD-2-Clause |
| normalize-package-data | 3.0.3 | npm | third-party | BSD-2-Clause |
| npm-run-path | 4.0.1 | npm | third-party | MIT |
| object-is | 1.1.6 | npm | third-party | MIT |
| object-keys | 1.1.1 | npm | third-party | MIT |
| onetime | 5.1.2 | npm | third-party | MIT |
| opencollective-postinstall | 2.0.3 | npm | third-party | MIT |
| optionator | 0.8.3 | npm | third-party | MIT |
| optionator | 0.9.4 | npm | third-party | MIT |
| p-limit | 2.3.0 | npm | third-party | MIT |
| p-limit | 3.1.0 | npm | third-party | MIT |
| p-locate | 4.1.0 | npm | third-party | MIT |
| p-locate | 5.0.0 | npm | third-party | MIT |
| p-try | 2.2.0 | npm | third-party | MIT |
| parent-module | 1.0.1 | npm | third-party | MIT |
| parse-json | 5.2.0 | npm | third-party | MIT |
| path-exists | 4.0.0 | npm | third-party | MIT |
| path-key | 3.1.1 | npm | third-party | MIT |
| path-parse | 1.0.7 | npm | third-party | MIT |
| picocolors | 1.1.1 | npm | third-party | ISC |
| picomatch | 4.0.4 | npm | third-party | MIT |
| possible-typed-array-names | 1.1.0 | npm | third-party | MIT |
| postcss | 8.5.14 | npm | third-party | MIT |
| prelude-ls | 1.1.2 | npm | third-party | MIT |
| prelude-ls | 1.2.1 | npm | third-party | MIT |
| prettier | 3.8.1 | npm | third-party | MIT |
| prettier-linter-helpers | 1.0.1 | npm | third-party | MIT |
| process | 0.11.10 | npm | third-party | MIT |
| punycode | 2.3.1 | npm | third-party | MIT |
| quick-lru | 4.0.1 | npm | third-party | MIT |
| read-pkg | 5.2.0 | npm | third-party | MIT |
| read-pkg-up | 7.0.1 | npm | third-party | MIT |
| redent | 3.0.0 | npm | third-party | MIT |
| reflect-metadata | 0.1.13 | npm | third-party | Apache-2.0 |
| regexpp | 3.2.0 | npm | third-party | MIT |
| resolve | 1.22.11 | npm | third-party | MIT |
| resolve-from | 4.0.0 | npm | third-party | MIT |
| resolve-pkg-maps | 1.0.0 | npm | third-party | MIT |
| restore-cursor | 3.1.0 | npm | third-party | MIT |
| rolldown | 1.0.1 | npm | third-party | MIT |
| run-async | 2.4.1 | npm | third-party | MIT |
| rxjs | 6.6.7 | npm | third-party | Apache-2.0 |
| safe-regex-test | 1.1.0 | npm | third-party | MIT |
| safer-buffer | 2.1.2 | npm | third-party | MIT |
| semver | 5.7.2 | npm | third-party | ISC |
| semver | 6.3.1 | npm | third-party | ISC |
| semver | 7.7.4 | npm | third-party | ISC |
| set-function-length | 1.2.2 | npm | third-party | MIT |
| shebang-command | 2.0.0 | npm | third-party | MIT |
| shebang-regex | 3.0.0 | npm | third-party | MIT |
| signal-exit | 3.0.7 | npm | third-party | ISC |
| signal-exit | 4.1.0 | npm | third-party | ISC |
| source-map | 0.6.1 | npm | third-party | BSD-3-Clause |
| source-map-js | 1.2.1 | npm | third-party | BSD-3-Clause |
| source-map-support | 0.5.21 | npm | third-party | MIT |
| spdx-correct | 3.2.0 | npm | third-party | Apache-2.0 |
| spdx-exceptions | 2.5.0 | npm | third-party | CC-BY-3.0 |
| spdx-expression-parse | 3.0.1 | npm | third-party | MIT |
| spdx-license-ids | 3.0.23 | npm | third-party | CC0-1.0 |
| string-template | 1.0.0 | npm | third-party | MIT |
| string-width | 4.2.3 | npm | third-party | MIT |
| stringz | 2.1.0 | npm | third-party | MIT |
| strip-ansi | 6.0.1 | npm | third-party | MIT |
| strip-final-newline | 2.0.0 | npm | third-party | MIT |
| strip-indent | 3.0.0 | npm | third-party | MIT |
| strip-json-comments | 3.1.1 | npm | third-party | MIT |
| supports-color | 7.2.0 | npm | third-party | MIT |
| supports-preserve-symlinks-flag | 1.0.0 | npm | third-party | MIT |
| synckit | 0.11.12 | npm | third-party | MIT |
| tailwindcss | 4.2.2 | npm | third-party | MIT |
| tapable | 2.3.2 | npm | third-party | MIT |
| terser | 5.46.1 | npm | third-party | BSD-2-Clause |
| through | 2.3.8 | npm | third-party | MIT |
| tinyglobby | 0.2.15 | npm | third-party | MIT |
| tinyglobby | 0.2.16 | npm | third-party | MIT |
| tmp | 0.2.7 | npm | third-party | MIT |
| trim-newlines | 3.0.1 | npm | third-party | MIT |
| ts-api-utils | 2.5.0 | npm | third-party | MIT |
| ts-declaration-location | 1.0.7 | npm | third-party | BSD-3-Clause |
| tslib | 1.14.1 | npm | third-party | 0BSD |
| tslib | 2.5.0 | npm | third-party | 0BSD |
| tslib | 2.8.1 | npm | third-party | 0BSD |
| type-check | 0.3.2 | npm | third-party | MIT |
| type-check | 0.4.0 | npm | third-party | MIT |
| type-fest | 0.18.1 | npm | third-party | (MIT OR CC0-1.0) |
| type-fest | 0.21.3 | npm | third-party | (MIT OR CC0-1.0) |
| type-fest | 0.6.0 | npm | third-party | (MIT OR CC0-1.0) |
| type-fest | 0.8.1 | npm | third-party | (MIT OR CC0-1.0) |
| typescript | 6.0.2 | npm | third-party | Apache-2.0 |
| typescript-eslint | 8.58.0 | npm | third-party | MIT |
| undici-types | 7.18.2 | npm | third-party | MIT |
| uri-js | 4.4.1 | npm | third-party | BSD-2-Clause |
| urlpattern-polyfill | 10.1.0 | npm | third-party | MIT |
| util | 0.12.5 | npm | third-party | MIT |
| validate-npm-package-license | 3.0.4 | npm | third-party | Apache-2.0 |
| validator | 13.15.35 | npm | third-party | MIT |
| vite | 8.0.13 | npm | third-party | MIT |
| which | 2.0.2 | npm | third-party | ISC |
| which-typed-array | 1.1.20 | npm | third-party | MIT |
| word-wrap | 1.2.5 | npm | third-party | MIT |
| write-file-atomic | 6.0.0 | npm | third-party | ISC |
| yallist | 4.0.0 | npm | third-party | ISC |
| yargs-parser | 20.2.9 | npm | third-party | ISC |
| yocto-queue | 0.1.0 | npm | third-party | MIT |
| @sigmashake/ssqa | file:../sigmashake-ssqa | npm | first-party | SigmaShake Proprietary |
Runtime & packaging. Single self-contained Go binary (CGO_ENABLED=0): pure-Go in-process eval engine (goengine) + React dashboard SPA (Vite-bundled, go:embed). Audit store: modernc.org/sqlite (pure-Go, zero-CGO — no bundled C SQLite). Native Rust/Zig sidecar ships as SSG_EVAL_ENGINE=sidecar escape hatch for one transition release. Bun is build-time toolchain only — NOT in the distributed binary. No runtime install of Node, npm, or Bun packages.
sigmashake-desktop-linux@0.1.113
No third-party code reaches the shipped artifact.
Nothing in this group.
Runtime & packaging. Platform-native binaries — NOT Bun/Electrobun bundles. Linux: Go + Wails v2, system WebKitGTK WebView, supervises ssg daemon + ssg serve. macOS: Swift/AppKit, WKWebView. Windows: C#/.NET 8 WinForms + WebView2. Bun is build-time toolchain only. The governance dashboard SPA is served by the ssg daemon (see ssg.cdx.json) and is not re-bundled in the desktop shell. This SBOM is a summary-level inventory for the Linux variant (npmRoot: sigmashake-desktop-linux); macOS and Windows are host-OS-gated builds.
sigmashake-workspace@0.1.2
Third-party and first-party code compiled or bundled into the artifact a customer installs and runs.
| Component | Version | Ecosystem | Origin | License |
|---|---|---|---|---|
| hono | 4.12.18 | npm | third-party | MIT |
| react | 19.2.4 | npm | third-party | MIT |
| react-dom | 19.2.4 | npm | third-party | MIT |
| scheduler | 0.27.0 | npm | third-party | MIT |
| Component | Version | Ecosystem | Origin | License |
|---|---|---|---|---|
| @babel/code-frame | 7.29.7 | npm | third-party | MIT |
| @babel/helper-string-parser | 7.29.7 | npm | third-party | MIT |
| @babel/helper-validator-identifier | 7.29.7 | npm | third-party | MIT |
| @babel/parser | 7.29.7 | npm | third-party | MIT |
| @babel/runtime | 7.29.7 | npm | third-party | MIT |
| @babel/types | 7.29.7 | npm | third-party | MIT |
| @bcoe/v8-coverage | 1.0.2 | npm | third-party | MIT |
| @cloudflare/kv-asset-handler | 0.4.2 | npm | third-party | MIT OR Apache-2.0 |
| @cloudflare/kv-asset-handler | 0.5.0 | npm | third-party | MIT OR Apache-2.0 |
| @cloudflare/unenv-preset | 2.16.0 | npm | third-party | MIT OR Apache-2.0 |
| @cloudflare/unenv-preset | 2.16.1 | npm | third-party | MIT OR Apache-2.0 |
| @cloudflare/vitest-pool-workers | 0.14.9 | npm | third-party | MIT |
| @cloudflare/workerd-darwin-64 | 1.20260421.1 | npm | third-party | — |
| @cloudflare/workerd-darwin-64 | 1.20260508.1 | npm | third-party | — |
| @cloudflare/workerd-darwin-arm64 | 1.20260421.1 | npm | third-party | — |
| @cloudflare/workerd-darwin-arm64 | 1.20260508.1 | npm | third-party | — |
| @cloudflare/workerd-linux-64 | 1.20260421.1 | npm | third-party | Apache-2.0 |
| @cloudflare/workerd-linux-64 | 1.20260508.1 | npm | third-party | Apache-2.0 |
| @cloudflare/workerd-linux-arm64 | 1.20260421.1 | npm | third-party | — |
| @cloudflare/workerd-linux-arm64 | 1.20260508.1 | npm | third-party | — |
| @cloudflare/workerd-windows-64 | 1.20260421.1 | npm | third-party | — |
| @cloudflare/workerd-windows-64 | 1.20260508.1 | npm | third-party | — |
| @cloudflare/workers-types | 4.20260317.1 | npm | third-party | MIT OR Apache-2.0 |
| @cspotcode/source-map-support | 0.8.1 | npm | third-party | MIT |
| @emnapi/core | 1.10.0 | npm | third-party | — |
| @emnapi/runtime | 1.10.0 | npm | third-party | — |
| @emnapi/wasi-threads | 1.2.1 | npm | third-party | — |
| @esbuild/aix-ppc64 | 0.27.3 | npm | third-party | — |
| @esbuild/android-arm | 0.27.3 | npm | third-party | — |
| @esbuild/android-arm64 | 0.27.3 | npm | third-party | — |
| @esbuild/android-x64 | 0.27.3 | npm | third-party | — |
| @esbuild/darwin-arm64 | 0.27.3 | npm | third-party | — |
| @esbuild/darwin-x64 | 0.27.3 | npm | third-party | — |
| @esbuild/freebsd-arm64 | 0.27.3 | npm | third-party | — |
| @esbuild/freebsd-x64 | 0.27.3 | npm | third-party | — |
| @esbuild/linux-arm | 0.27.3 | npm | third-party | — |
| @esbuild/linux-arm64 | 0.27.3 | npm | third-party | — |
| @esbuild/linux-ia32 | 0.27.3 | npm | third-party | — |
| @esbuild/linux-loong64 | 0.27.3 | npm | third-party | — |
| @esbuild/linux-mips64el | 0.27.3 | npm | third-party | — |
| @esbuild/linux-ppc64 | 0.27.3 | npm | third-party | — |
| @esbuild/linux-riscv64 | 0.27.3 | npm | third-party | — |
| @esbuild/linux-s390x | 0.27.3 | npm | third-party | — |
| @esbuild/linux-x64 | 0.27.3 | npm | third-party | MIT |
| @esbuild/netbsd-arm64 | 0.27.3 | npm | third-party | — |
| @esbuild/netbsd-x64 | 0.27.3 | npm | third-party | — |
| @esbuild/openbsd-arm64 | 0.27.3 | npm | third-party | — |
| @esbuild/openbsd-x64 | 0.27.3 | npm | third-party | — |
| @esbuild/openharmony-arm64 | 0.27.3 | npm | third-party | — |
| @esbuild/sunos-x64 | 0.27.3 | npm | third-party | — |
| @esbuild/win32-arm64 | 0.27.3 | npm | third-party | — |
| @esbuild/win32-ia32 | 0.27.3 | npm | third-party | — |
| @esbuild/win32-x64 | 0.27.3 | npm | third-party | — |
| @img/colour | 1.1.0 | npm | third-party | MIT |
| @img/sharp-darwin-arm64 | 0.34.5 | npm | third-party | — |
| @img/sharp-darwin-x64 | 0.34.5 | npm | third-party | — |
| @img/sharp-libvips-darwin-arm64 | 1.2.4 | npm | third-party | — |
| @img/sharp-libvips-darwin-x64 | 1.2.4 | npm | third-party | — |
| @img/sharp-libvips-linux-arm | 1.2.4 | npm | third-party | — |
| @img/sharp-libvips-linux-arm64 | 1.2.4 | npm | third-party | — |
| @img/sharp-libvips-linux-ppc64 | 1.2.4 | npm | third-party | — |
| @img/sharp-libvips-linux-riscv64 | 1.2.4 | npm | third-party | — |
| @img/sharp-libvips-linux-s390x | 1.2.4 | npm | third-party | — |
| @img/sharp-libvips-linux-x64 | 1.2.4 | npm | third-party | LGPL-3.0-or-later |
| @img/sharp-libvips-linuxmusl-arm64 | 1.2.4 | npm | third-party | — |
| @img/sharp-libvips-linuxmusl-x64 | 1.2.4 | npm | third-party | LGPL-3.0-or-later |
| @img/sharp-linux-arm | 0.34.5 | npm | third-party | — |
| @img/sharp-linux-arm64 | 0.34.5 | npm | third-party | — |
| @img/sharp-linux-ppc64 | 0.34.5 | npm | third-party | — |
| @img/sharp-linux-riscv64 | 0.34.5 | npm | third-party | — |
| @img/sharp-linux-s390x | 0.34.5 | npm | third-party | — |
| @img/sharp-linux-x64 | 0.34.5 | npm | third-party | Apache-2.0 |
| @img/sharp-linuxmusl-arm64 | 0.34.5 | npm | third-party | — |
| @img/sharp-linuxmusl-x64 | 0.34.5 | npm | third-party | Apache-2.0 |
| @img/sharp-wasm32 | 0.34.5 | npm | third-party | — |
| @img/sharp-win32-arm64 | 0.34.5 | npm | third-party | — |
| @img/sharp-win32-ia32 | 0.34.5 | npm | third-party | — |
| @img/sharp-win32-x64 | 0.34.5 | npm | third-party | — |
| @jridgewell/resolve-uri | 3.1.2 | npm | third-party | MIT |
| @jridgewell/sourcemap-codec | 1.5.5 | npm | third-party | MIT |
| @jridgewell/trace-mapping | 0.3.31 | npm | third-party | MIT |
| @jridgewell/trace-mapping | 0.3.9 | npm | third-party | MIT |
| @napi-rs/wasm-runtime | 1.1.4 | npm | third-party | — |
| @oxc-project/types | 0.130.0 | npm | third-party | MIT |
| @poppinss/colors | 4.1.6 | npm | third-party | MIT |
| @poppinss/dumper | 0.6.5 | npm | third-party | MIT |
| @poppinss/exception | 1.2.3 | npm | third-party | MIT |
| @rolldown/binding-android-arm64 | 1.0.1 | npm | third-party | — |
| @rolldown/binding-darwin-arm64 | 1.0.1 | npm | third-party | — |
| @rolldown/binding-darwin-x64 | 1.0.1 | npm | third-party | — |
| @rolldown/binding-freebsd-x64 | 1.0.1 | npm | third-party | — |
| @rolldown/binding-linux-arm-gnueabihf | 1.0.1 | npm | third-party | — |
| @rolldown/binding-linux-arm64-gnu | 1.0.1 | npm | third-party | — |
| @rolldown/binding-linux-arm64-musl | 1.0.1 | npm | third-party | — |
| @rolldown/binding-linux-ppc64-gnu | 1.0.1 | npm | third-party | — |
| @rolldown/binding-linux-s390x-gnu | 1.0.1 | npm | third-party | — |
| @rolldown/binding-linux-x64-gnu | 1.0.1 | npm | third-party | MIT |
| @rolldown/binding-linux-x64-musl | 1.0.1 | npm | third-party | MIT |
| @rolldown/binding-openharmony-arm64 | 1.0.1 | npm | third-party | — |
| @rolldown/binding-wasm32-wasi | 1.0.1 | npm | third-party | — |
| @rolldown/binding-win32-arm64-msvc | 1.0.1 | npm | third-party | — |
| @rolldown/binding-win32-x64-msvc | 1.0.1 | npm | third-party | — |
| @rolldown/pluginutils | 1.0.0-rc.7 | npm | third-party | MIT |
| @rolldown/pluginutils | 1.0.1 | npm | third-party | MIT |
| @sindresorhus/is | 7.2.0 | npm | third-party | MIT |
| @speed-highlight/core | 1.2.15 | npm | third-party | CC0-1.0 |
| @standard-schema/spec | 1.1.0 | npm | third-party | MIT |
| @testing-library/dom | 10.4.1 | npm | third-party | MIT |
| @testing-library/react | 16.3.2 | npm | third-party | MIT |
| @testing-library/user-event | 14.6.1 | npm | third-party | MIT |
| @tybys/wasm-util | 0.10.2 | npm | third-party | — |
| @types/aria-query | 5.0.4 | npm | third-party | MIT |
| @types/chai | 5.2.3 | npm | third-party | MIT |
| @types/deep-eql | 4.0.2 | npm | third-party | MIT |
| @types/estree | 1.0.8 | npm | third-party | MIT |
| @types/react | 19.2.14 | npm | third-party | MIT |
| @types/react-dom | 19.2.3 | npm | third-party | MIT |
| @vitejs/plugin-react | 6.0.1 | npm | third-party | MIT |
| @vitest/coverage-v8 | 4.1.0 | npm | third-party | MIT |
| @vitest/expect | 4.1.0 | npm | third-party | MIT |
| @vitest/mocker | 4.1.0 | npm | third-party | MIT |
| @vitest/pretty-format | 4.1.0 | npm | third-party | MIT |
| @vitest/runner | 4.1.0 | npm | third-party | MIT |
| @vitest/snapshot | 4.1.0 | npm | third-party | MIT |
| @vitest/spy | 4.1.0 | npm | third-party | MIT |
| @vitest/utils | 4.1.0 | npm | third-party | MIT |
| ansi-regex | 5.0.1 | npm | third-party | MIT |
| ansi-styles | 5.2.0 | npm | third-party | MIT |
| aria-query | 5.3.0 | npm | third-party | Apache-2.0 |
| assertion-error | 2.0.1 | npm | third-party | MIT |
| ast-v8-to-istanbul | 1.0.3 | npm | third-party | MIT |
| blake3-wasm | 2.1.5 | npm | third-party | MIT |
| chai | 6.2.2 | npm | third-party | MIT |
| cjs-module-lexer | 1.4.3 | npm | third-party | MIT |
| convert-source-map | 2.0.0 | npm | third-party | MIT |
| cookie | 1.1.1 | npm | third-party | MIT |
| csstype | 3.2.3 | npm | third-party | MIT |
| dequal | 2.0.3 | npm | third-party | MIT |
| detect-libc | 2.1.2 | npm | third-party | Apache-2.0 |
| dom-accessibility-api | 0.5.16 | npm | third-party | MIT |
| entities | 4.5.0 | npm | third-party | BSD-2-Clause |
| error-stack-parser-es | 1.0.5 | npm | third-party | MIT |
| es-module-lexer | 2.1.0 | npm | third-party | MIT |
| esbuild | 0.27.3 | npm | third-party | MIT |
| estree-walker | 3.0.3 | npm | third-party | MIT |
| expect-type | 1.3.0 | npm | third-party | Apache-2.0 |
| fdir | 6.5.0 | npm | third-party | MIT |
| fsevents | 2.3.3 | npm | third-party | — |
| happy-dom | 15.11.7 | npm | third-party | MIT |
| has-flag | 4.0.0 | npm | third-party | MIT |
| html-escaper | 2.0.2 | npm | third-party | MIT |
| istanbul-lib-coverage | 3.2.2 | npm | third-party | BSD-3-Clause |
| istanbul-lib-report | 3.0.1 | npm | third-party | BSD-3-Clause |
| istanbul-reports | 3.2.0 | npm | third-party | BSD-3-Clause |
| js-tokens | 10.0.0 | npm | third-party | MIT |
| js-tokens | 4.0.0 | npm | third-party | MIT |
| kleur | 4.1.5 | npm | third-party | MIT |
| lightningcss | 1.32.0 | npm | third-party | MPL-2.0 |
| lightningcss-android-arm64 | 1.32.0 | npm | third-party | — |
| lightningcss-darwin-arm64 | 1.32.0 | npm | third-party | — |
| lightningcss-darwin-x64 | 1.32.0 | npm | third-party | — |
| lightningcss-freebsd-x64 | 1.32.0 | npm | third-party | — |
| lightningcss-linux-arm-gnueabihf | 1.32.0 | npm | third-party | — |
| lightningcss-linux-arm64-gnu | 1.32.0 | npm | third-party | — |
| lightningcss-linux-arm64-musl | 1.32.0 | npm | third-party | — |
| lightningcss-linux-x64-gnu | 1.32.0 | npm | third-party | MPL-2.0 |
| lightningcss-linux-x64-musl | 1.32.0 | npm | third-party | MPL-2.0 |
| lightningcss-win32-arm64-msvc | 1.32.0 | npm | third-party | — |
| lightningcss-win32-x64-msvc | 1.32.0 | npm | third-party | — |
| lz-string | 1.5.0 | npm | third-party | MIT |
| magic-string | 0.30.21 | npm | third-party | MIT |
| magicast | 0.5.3 | npm | third-party | MIT |
| make-dir | 4.0.0 | npm | third-party | MIT |
| miniflare | 4.20260421.0 | npm | third-party | MIT |
| miniflare | 4.20260508.0 | npm | third-party | MIT |
| nanoid | 3.3.12 | npm | third-party | MIT |
| obug | 2.1.1 | npm | third-party | MIT |
| path-to-regexp | 6.3.0 | npm | third-party | MIT |
| pathe | 2.0.3 | npm | third-party | MIT |
| picocolors | 1.1.1 | npm | third-party | ISC |
| picomatch | 4.0.4 | npm | third-party | MIT |
| postcss | 8.5.14 | npm | third-party | MIT |
| pretty-format | 27.5.1 | npm | third-party | MIT |
| react-is | 17.0.2 | npm | third-party | MIT |
| rolldown | 1.0.1 | npm | third-party | MIT |
| semver | 7.8.0 | npm | third-party | ISC |
| sharp | 0.34.5 | npm | third-party | Apache-2.0 |
| siginfo | 2.0.0 | npm | third-party | ISC |
| source-map-js | 1.2.1 | npm | third-party | BSD-3-Clause |
| stackback | 0.0.2 | npm | third-party | MIT |
| std-env | 4.1.0 | npm | third-party | MIT |
| supports-color | 10.2.2 | npm | third-party | MIT |
| supports-color | 7.2.0 | npm | third-party | MIT |
| tinybench | 2.9.0 | npm | third-party | MIT |
| tinyexec | 1.1.2 | npm | third-party | MIT |
| tinyglobby | 0.2.16 | npm | third-party | MIT |
| tinyrainbow | 3.1.0 | npm | third-party | MIT |
| tslib | 2.8.1 | npm | third-party | — |
| typescript | 6.0.2 | npm | third-party | Apache-2.0 |
| undici | 7.24.8 | npm | third-party | MIT |
| unenv | 2.0.0-rc.24 | npm | third-party | MIT |
| vite | 8.0.13 | npm | third-party | MIT |
| vitest | 4.1.0 | npm | third-party | MIT |
| webidl-conversions | 7.0.0 | npm | third-party | BSD-2-Clause |
| whatwg-mimetype | 3.0.0 | npm | third-party | MIT |
| why-is-node-running | 2.3.0 | npm | third-party | MIT |
| workerd | 1.20260421.1 | npm | third-party | Apache-2.0 |
| workerd | 1.20260508.1 | npm | third-party | Apache-2.0 |
| wrangler | 4.84.1 | npm | third-party | MIT OR Apache-2.0 |
| wrangler | 4.90.1 | npm | third-party | MIT OR Apache-2.0 |
| ws | 8.18.0 | npm | third-party | MIT |
| youch | 4.1.0-beta.10 | npm | third-party | MIT |
| youch-core | 0.3.3 | npm | third-party | MIT |
| zod | 3.25.76 | npm | third-party | MIT |
Runtime & packaging. Ships as a Cloudflare Worker bundle, a local-web bundle served by the SSG daemon, an embedded WebView in SigmaShake Desktop, and a VS Code extension. The JavaScript runtime is provided by the host (workerd / Node / system WebView) and is not redistributed by SigmaShake.
Every component is tagged on four axes. The page foregrounds what reaches a customer — the third-party code shipped in each artifact — and tucks the build-only toolchain behind a collapsible section.
origin — first-party vs. third-partydistributed — what actually shipsphase — runtime vs. build