@apollographql/graphql-upload-8-fork

Fork of graphql-upload@8 that works with graphql@15 for compatibility with apollo-server@2

Supply chain provenance

Status for the latest visible version.

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

Keywords

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
provenance	publisher-changed	AI (provenance): Publisher change from apollo-bot to glasser reflects a legitimate Apollo team transition; glasser is a known Apollo engineer with strong track record.	ai	2026/04/23
maintainer-change	maintainer-added	AI (maintainer-change): glasser and trevor.scheer are known Apollo GraphQL engineers; addition is consistent with legitimate team transition.	ai	2026/04/23
maintainer-change	maintainer-removed	AI (maintainer-change): Removal of older maintainers is consistent with Apollo team restructuring, not a hostile takeover.	ai	2026/04/23
publish-pattern	dormant-publish	AI (publish-pattern): This is a legacy compatibility fork for apollo-server@2; long dormancy is expected and the publish is by a trusted Apollo engineer.	ai	2026/04/23
phantom-deps	phantom-dep:@types/koa	AI (phantom-deps): @types/koa is a TypeScript type declaration included as a runtime dep for consumers; not a security concern.	ai	2026/04/23
phantom-deps	phantom-dep:@types/express	AI (phantom-deps): @types/express is a TypeScript type declaration included as a runtime dep for consumers; not a security concern.	ai	2026/04/23
phantom-deps	phantom-dep:@types/fs-capacitor	AI (phantom-deps): @types/fs-capacitor is a TypeScript type declaration included as a runtime dep for consumers; not a security concern.	ai	2026/04/23

Version	Deps	Published
8.1.4	7 / 22	2022-10-20
8.1.3	7 / 22	2021-02-11
8.1.2	4 / 22	2021-02-11
8.1.1	4 / 22	2021-02-11