@adobe/spacecat-shared-utils
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Adobe org migrated publishing to GitHub Actions CI/CD; SLSA provenance attestation confirms supply chain integrity. | ai | |
| dependencies | unvetted-dep:@adobe/spacecat-shared-ims-client | AI (dependencies): First-party Adobe/spacecat package from the same org and publisher lineage. | ai | |
| dependencies | unvetted-dep:aws-xray-sdk | AI (dependencies): aws-xray-sdk is an official AWS observability SDK; no malware indicators, stable dependency for this package. | ai | |
| dependencies | unvetted-dep:@json2csv/plainjs | AI (dependencies): @json2csv/plainjs is a well-known CSV conversion library; no malware indicators, stable dependency for this package. | ai |
Versions (showing 33 of 233)
| Version | Deps | Published |
|---|---|---|
| 1.28.2 | 7 / 8 | |
| 1.28.1 | 7 / 8 | |
| 1.28.0 | 7 / 8 | |
| 1.27.0 | 7 / 8 | |
| 1.26.6 | 7 / 8 | |
| 1.26.5 | 7 / 8 | |
| 1.26.4 | 7 / 8 | |
| 1.26.3 | 7 / 8 | |
| 1.26.2 | 7 / 8 | |
| 1.26.1 | 7 / 8 | |
| 1.26.0 | 7 / 8 | |
| 1.25.5 | 6 / 8 | |
| 1.25.4 | 6 / 8 | |
| 1.25.3 | 6 / 8 | |
| 1.25.2 | 6 / 8 | |
| 1.25.1 | 6 / 8 | |
| 1.25.0 | 6 / 8 | |
| 1.24.1 | 6 / 8 | |
| 1.24.0 | 6 / 8 | |
| 1.23.8 | 5 / 8 | |
| 1.23.7 | 5 / 8 | |
| 1.23.6 | 5 / 8 | |
| 1.23.5 | 5 / 8 | |
| 1.23.4 | 5 / 8 | |
| 1.23.3 | 5 / 8 | |
| 1.23.2 | 5 / 8 | |
| 1.23.1 | 5 / 8 | |
| 1.23.0 | 5 / 8 | |
| 1.22.7 | 5 / 8 | |
| 1.22.6 | 5 / 8 | |
| 1.22.5 | 5 / 8 | |
| 1.22.4 | 5 / 8 | |
| 1.15.0 | 5 / 7 |
v1.28.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.28.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.28.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.27.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.26.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.26.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.26.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.26.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.26.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.26.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.26.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.25.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.25.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.25.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.25.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.25.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.25.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.24.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.24.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.23.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.23.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.23.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.23.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.23.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.23.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.23.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.23.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.23.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.22.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.22.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.22.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.22.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.15.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.