All @apollo/query-graphs versions
@apollo/query-graphs @2.13.2
rejected
This version was rejected.
It did not pass GreenFlagged's security review and is not served by the registry.
The findings and risk dispositions below explain why.
60
Risk Score
—
License
No
Install Scripts
4
Dependencies
0
Dev Dependencies
156.4 KB
Package Size
Published
Maintainers
dkucapollo-botphryneasabernix
Keywords
graphqlfederationapollo
Dependencies (4)
| Package | Constraint | Registry Status |
|---|---|---|
| uuid | ^9.0.0 | auto_approved |
| deep-equal | ^2.0.5 | auto_approved |
| ts-graphviz | ^1.5.4 | pending |
| @apollo/federation-internals | 2.13.2 | auto_approved |
Transitive Dependency Tree
63 transitive deps
max depth 9
├─
@apollo/federation-internals
2.13.2
├─
deep-equal
^2.0.5
→ 2.2.2
├─
ts-graphviz
^1.5.4
├─
uuid
^9.0.0
→ 9.0.1
├─
array-buffer-byte-length
^1.0.0
→ 1.0.2
├─
call-bind
^1.0.2
→ 1.0.9
├─
es-get-iterator
^1.1.3
→ 1.1.3
├─
get-intrinsic
^1.2.1
→ 1.3.1
├─
is-arguments
^1.1.1
→ 1.2.0
├─
is-array-buffer
^3.0.2
→ 3.0.5
├─
is-date-object
^1.0.5
→ 1.1.0
├─
is-regex
^1.1.4
→ 1.2.1
├─
is-shared-array-buffer
^1.0.2
→ 1.0.4
├─
isarray
^2.0.5
→ 2.0.5
├─
object-is
^1.1.5
→ 1.1.6
├─
object-keys
^1.1.1
→ 1.1.1
├─
object.assign
^4.1.4
→ 4.1.7
├─
regexp.prototype.flags
^1.5.0
→ 1.5.4
├─
side-channel
^1.0.4
→ 1.1.0
├─
which-boxed-primitive
^1.0.2
→ 1.1.1
├─
which-collection
^1.0.1
→ 1.0.2
├─
which-typed-array
^1.1.9
→ 1.1.20
├─
async-function
^1.0.0
├─
async-generator-function
^1.0.0
→ 1.0.0
├─
available-typed-arrays
^1.0.7
→ 1.0.7
├─
call-bind
^1.0.8
→ 1.0.9
├─
call-bind
^1.0.2
→ 1.0.9
├─
call-bind
^1.0.7
→ 1.0.9
├─
call-bind-apply-helpers
^1.0.2
→ 1.0.2
├─
call-bound
^1.0.3
→ 1.0.4
├─
call-bound
^1.0.2
→ 1.0.4
├─
call-bound
^1.0.4
→ 1.0.4
├─
define-properties
^1.2.1
→ 1.2.1
├─
es-define-property
^1.0.1
→ 1.0.1
├─
es-errors
^1.3.0
→ 1.3.0
├─
es-object-atoms
^1.1.1
→ 1.1.1
├─
es-object-atoms
^1.0.0
→ 1.1.1
├─
for-each
^0.3.5
→ 0.3.5
├─
function-bind
^1.1.2
→ 1.1.2
├─
generator-function
^2.0.0
→ 2.0.1
├─
get-intrinsic
^1.1.3
→ 1.3.1
├─
get-intrinsic
^1.2.6
→ 1.3.1
├─
get-intrinsic
^1.3.0
→ 1.3.1
├─
get-proto
^1.0.1
├─
get-proto
^1.0.1
→ 1.0.1
├─
gopd
^1.2.0
├─
has-symbols
^1.1.0
→ 1.1.0
├─
has-symbols
^1.0.3
→ 1.1.0
├─
has-tostringtag
^1.0.2
→ 1.0.2
├─
hasown
^2.0.2
→ 2.0.3
├─
is-arguments
^1.1.1
├─
is-array-buffer
^3.0.5
├─
is-bigint
^1.1.0
├─
is-boolean-object
^1.2.1
├─
is-map
^2.0.2
├─
is-map
^2.0.3
├─
is-number-object
^1.1.1
├─
is-set
^2.0.2
├─
is-set
^2.0.3
→ 2.0.3
├─
is-string
^1.0.7
├─
is-string
^1.1.1
→ 1.1.1
├─
is-symbol
^1.1.1
→ 1.1.1
├─
is-weakmap
^2.0.2
├─
is-weakset
^2.0.3
├─
isarray
^2.0.5
├─
math-intrinsics
^1.1.0
→ 1.1.0
├─
object-inspect
^1.13.3
→ 1.13.4
├─
object-keys
^1.1.1
→ 1.1.1
├─
set-function-length
^1.2.2
→ 1.2.2
├─
set-function-name
^2.0.2
→ 2.0.2
├─
side-channel-list
^1.0.0
→ 1.0.1
├─
side-channel-map
^1.0.1
→ 1.0.1
├─
side-channel-weakmap
^1.0.2
→ 1.0.2
├─
stop-iteration-iterator
^1.0.0
├─
async-function
^1.0.0
├─
async-generator-function
^1.0.0
→ 1.0.0
├─
call-bind-apply-helpers
^1.0.2
→ 1.0.2
├─
call-bound
^1.0.3
→ 1.0.4
├─
call-bound
^1.0.2
→ 1.0.4
├─
define-data-property
^1.1.4
├─
define-data-property
^1.0.1
├─
dunder-proto
^1.0.1
→ 1.0.1
├─
es-define-property
^1.0.1
→ 1.0.1
├─
es-errors
^1.3.0
→ 1.3.0
├─
es-object-atoms
^1.0.0
→ 1.1.1
├─
es-object-atoms
^1.1.1
→ 1.1.1
├─
function-bind
^1.1.2
→ 1.1.2
├─
functions-have-names
^1.2.3
→ 1.2.3
├─
generator-function
^2.0.0
→ 2.0.1
├─
get-intrinsic
^1.3.0
→ 1.3.1
├─
get-intrinsic
^1.2.5
→ 1.3.1
├─
get-intrinsic
^1.2.4
→ 1.3.1
├─
get-proto
^1.0.1
├─
gopd
^1.2.0
├─
gopd
^1.0.1
├─
has-property-descriptors
^1.0.2
→ 1.0.2
├─
has-property-descriptors
^1.0.0
→ 1.0.2
├─
has-symbols
^1.1.0
→ 1.1.0
├─
has-symbols
^1.0.3
→ 1.1.0
├─
has-tostringtag
^1.0.2
→ 1.0.2
├─
hasown
^2.0.2
→ 2.0.3
├─
is-callable
^1.2.7
→ 1.2.7
├─
math-intrinsics
^1.1.0
→ 1.1.0
├─
object-inspect
^1.13.3
→ 1.13.4
├─
object-inspect
^1.13.4
→ 1.13.4
├─
object-keys
^1.1.1
→ 1.1.1
├─
possible-typed-array-names
^1.0.0
→ 1.1.0
├─
safe-regex-test
^1.1.0
→ 1.1.0
├─
set-function-length
^1.2.2
→ 1.2.2
├─
side-channel-map
^1.0.1
→ 1.0.1
├─
async-function
^1.0.0
├─
async-generator-function
^1.0.0
→ 1.0.0
├─
call-bind-apply-helpers
^1.0.1
→ 1.0.2
├─
call-bind-apply-helpers
^1.0.2
→ 1.0.2
├─
call-bound
^1.0.2
→ 1.0.4
├─
define-data-property
^1.1.4
├─
es-define-property
^1.0.0
→ 1.0.1
├─
es-define-property
^1.0.1
→ 1.0.1
├─
es-errors
^1.3.0
→ 1.3.0
├─
es-object-atoms
^1.1.1
→ 1.1.1
├─
function-bind
^1.1.2
→ 1.1.2
├─
generator-function
^2.0.0
→ 2.0.1
├─
get-intrinsic
^1.3.0
→ 1.3.1
├─
get-intrinsic
^1.2.4
→ 1.3.1
├─
get-intrinsic
^1.2.5
→ 1.3.1
├─
get-proto
^1.0.1
├─
gopd
^1.0.1
├─
gopd
^1.2.0
├─
has-property-descriptors
^1.0.2
→ 1.0.2
├─
has-symbols
^1.0.3
→ 1.1.0
├─
has-symbols
^1.1.0
→ 1.1.0
├─
hasown
^2.0.2
→ 2.0.3
├─
is-regex
^1.2.1
→ 1.2.1
├─
math-intrinsics
^1.1.0
→ 1.1.0
├─
object-inspect
^1.13.3
→ 1.13.4
├─
async-function
^1.0.0
├─
async-generator-function
^1.0.0
→ 1.0.0
├─
call-bind-apply-helpers
^1.0.2
→ 1.0.2
├─
call-bound
^1.0.2
→ 1.0.4
├─
es-define-property
^1.0.0
→ 1.0.1
├─
es-define-property
^1.0.1
→ 1.0.1
├─
es-errors
^1.3.0
→ 1.3.0
├─
es-object-atoms
^1.1.1
→ 1.1.1
├─
function-bind
^1.1.2
→ 1.1.2
├─
generator-function
^2.0.0
→ 2.0.1
├─
get-intrinsic
^1.3.0
→ 1.3.1
├─
get-proto
^1.0.1
├─
gopd
^1.2.0
├─
has-symbols
^1.1.0
→ 1.1.0
├─
has-tostringtag
^1.0.2
→ 1.0.2
├─
hasown
^2.0.2
→ 2.0.3
├─
math-intrinsics
^1.1.0
→ 1.1.0
├─
async-function
^1.0.0
├─
async-generator-function
^1.0.0
→ 1.0.0
├─
call-bind-apply-helpers
^1.0.2
→ 1.0.2
├─
es-define-property
^1.0.1
→ 1.0.1
├─
es-errors
^1.3.0
→ 1.3.0
├─
es-object-atoms
^1.1.1
→ 1.1.1
├─
function-bind
^1.1.2
→ 1.1.2
├─
generator-function
^2.0.0
→ 2.0.1
├─
get-intrinsic
^1.3.0
→ 1.3.1
├─
get-proto
^1.0.1
├─
gopd
^1.2.0
├─
has-symbols
^1.0.3
→ 1.1.0
├─
has-symbols
^1.1.0
→ 1.1.0
├─
hasown
^2.0.2
→ 2.0.3
├─
math-intrinsics
^1.1.0
→ 1.1.0
├─
async-function
^1.0.0
├─
async-generator-function
^1.0.0
→ 1.0.0
├─
call-bind-apply-helpers
^1.0.2
→ 1.0.2
├─
es-define-property
^1.0.1
→ 1.0.1
├─
es-errors
^1.3.0
→ 1.3.0
├─
es-object-atoms
^1.1.1
→ 1.1.1
├─
function-bind
^1.1.2
→ 1.1.2
├─
generator-function
^2.0.0
→ 2.0.1
├─
get-proto
^1.0.1
├─
gopd
^1.2.0
├─
has-symbols
^1.1.0
→ 1.1.0
├─
hasown
^2.0.2
→ 2.0.3
├─
math-intrinsics
^1.1.0
→ 1.1.0
├─
es-errors
^1.3.0
→ 1.3.0
├─
function-bind
^1.1.2
→ 1.1.2
Changes from v2.13.1
Dependency Changes
| Change | Package | Version |
|---|---|---|
| changed | @apollo/federation-internals | 2.13.1 → 2.13.2 |
File Changes
0 added
0 removed
1 modified
size delta: .0 KB
Risk Dispositions (2 applicable to this version, 0 other)
Accepted rules are downgraded to INFO on future analyses; rejected rules escalate to CRITICAL.
| Rule | Source | Disposition | Author | Reason | |
|---|---|---|---|---|---|
regressed-provenance |
provenance | reject | AI | AI (provenance): Provenance regression on an established CI-published package is a strong compromise indicator; generalizes until CI publishing is restored. | |
publisher-changed |
provenance | reject | AI | AI (provenance): Publisher flip from GitHub Actions to human account without explanation is a disqualifying signal for this package. |
SAST Findings (2)
HIGH
Provenance attestation missing — previous versions had it
provenance
This version was published without provenance, but prior versions were published via CI/CD with attestations. This is a strong signal of a potential account compromise or unauthorized publish. The axios attack (March 2026) exhibited exactly this pattern.
HIGH
Publisher changed: GitHub Actions → dkuc (on 2026-03-13)
provenance
This version was published by a different npm account than previous versions on 2026-03-13. This could indicate a legitimate maintainer transition or an account compromise.
Review Summary
Risk score: 60. Findings: 2 high (+50), 1 medium (+10), 1 info (+0).
Commit: 83f0ae4daef7 Browse source
Published to npm: