@atlaskit/adf-schema
Shared package that contains the ADF-schema (json) and ProseMirror node/mark specs
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | missing-githead | AI (provenance): Atlassian publishes via internal artifact pipeline; missing gitHead is consistent with their known publish environment across @atlaskit packages. | ai | |
| provenance | no-provenance | AI (provenance): Atlassian's internal publish pipeline does not use Sigstore provenance; stable for all @atlaskit packages. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Large Atlassian monorepo package; minimal README and no keywords are expected for internal/ecosystem packages of this scale and age. | ai |
Versions (showing 100 of 104)
| Version | Deps | Published |
|---|---|---|
| 52.16.1 | 7 / 36 | |
| 52.16.0 | 7 / 36 | |
| 52.15.5 | 7 / 36 | |
| 52.15.4 | 7 / 36 | |
| 52.15.3 | 7 / 36 | |
| 52.15.2 | 7 / 36 | |
| 52.15.1 | 7 / 36 | |
| 52.15.0 | 8 / 36 | |
| 52.14.2 | 8 / 36 | |
| 52.14.1 | 8 / 36 | |
| 52.14.0 | 8 / 36 | |
| 52.13.1 | 8 / 36 | |
| 52.13.0 | 8 / 36 | |
| 52.12.0 | 8 / 36 | |
| 52.11.4 | 8 / 36 | |
| 52.11.3 | 8 / 36 | |
| 52.11.2 | 8 / 36 | |
| 52.11.1 | 8 / 36 | |
| 52.11.0 | 8 / 36 | |
| 52.10.1 | 8 / 36 | |
| 52.9.5 | 8 / 36 | |
| 52.9.4 | 8 / 36 | |
| 52.9.3 | 8 / 36 | |
| 52.9.2 | 8 / 36 | |
| 52.9.1 | 8 / 36 | |
| 52.9.0 | 8 / 36 | |
| 52.8.0 | 8 / 36 | |
| 52.7.1 | 8 / 36 | |
| 52.7.0 | 8 / 36 | |
| 52.6.6 | 8 / 36 | |
| 52.6.5 | 8 / 36 | |
| 52.6.4 | 8 / 36 | |
| 52.6.3 | 7 / 36 | |
| 52.6.2 | 7 / 36 | |
| 52.6.1 | 7 / 36 | |
| 52.6.0 | 7 / 36 | |
| 52.5.5 | 7 / 36 | |
| 52.5.4 | 7 / 36 | |
| 52.5.3 | 7 / 36 | |
| 52.5.2 | 7 / 36 | |
| 52.5.1 | 7 / 36 | |
| 52.5.0 | 7 / 36 | |
| 52.4.23 | 7 / 36 | |
| 52.4.22 | 7 / 36 | |
| 52.4.21 | 7 / 36 | |
| 52.4.20 | 7 / 36 | |
| 52.4.19 | 7 / 36 | |
| 52.4.18 | 7 / 36 | |
| 52.4.17 | 7 / 36 | |
| 52.4.16 | 7 / 36 | |
| 52.4.15 | 7 / 36 | |
| 52.4.14 | 7 / 36 | |
| 52.4.13 | 7 / 36 | |
| 52.4.12 | 7 / 36 | |
| 52.4.11 | 7 / 36 | |
| 52.4.10 | 7 / 36 | |
| 52.4.9 | 7 / 36 | |
| 52.4.8 | 7 / 36 | |
| 52.4.7 | 7 / 36 | |
| 52.4.6 | 7 / 36 | |
| 52.4.5 | 7 / 36 | |
| 52.4.4 | 7 / 36 | |
| 52.4.3 | 7 / 36 | |
| 52.4.2 | 7 / 36 | |
| 52.4.1 | 7 / 36 | |
| 52.4.0 | 7 / 36 | |
| 52.3.2 | 7 / 36 | |
| 52.3.1 | 7 / 36 | |
| 52.3.0 | 7 / 36 | |
| 52.2.6 | 7 / 36 | |
| 52.2.5 | 7 / 36 | |
| 52.2.4 | 7 / 36 | |
| 52.2.3 | 7 / 36 | |
| 52.2.2 | 7 / 36 | |
| 52.2.1 | 7 / 36 | |
| 52.2.0 | 7 / 36 | |
| 52.1.0 | 7 / 36 | |
| 52.0.1 | 7 / 36 | |
| 52.0.0 | 7 / 36 | |
| 51.5.23 | 7 / 36 | |
| 51.5.22 | 7 / 36 | |
| 51.5.21 | 7 / 35 | |
| 51.5.20 | 7 / 35 | |
| 51.5.19 | 7 / 35 | |
| 51.5.18 | 7 / 35 | |
| 51.5.17 | 7 / 35 | |
| 51.5.16 | 7 / 35 | |
| 51.5.15 | 7 / 35 | |
| 51.5.14 | 7 / 35 | |
| 51.5.13 | 7 / 35 | |
| 51.5.12 | 7 / 35 | |
| 51.5.11 | 7 / 35 | |
| 51.5.10 | 7 / 35 | |
| 51.5.9 | 7 / 35 | |
| 51.5.8 | 7 / 35 | |
| 51.5.7 | 7 / 35 | |
| 51.5.6 | 8 / 35 | |
| 51.5.5 | 7 / 35 | |
| 51.5.4 | 8 / 34 | |
| 51.5.3 | 9 / 34 |
v52.16.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.16.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.15.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.15.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.15.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.15.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.15.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.15.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.14.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.14.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.14.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.13.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.13.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.12.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.11.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.11.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.11.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.11.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.11.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.10.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.9.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.9.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.9.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.9.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.9.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.9.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.8.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.7.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.6.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.6.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v52.6.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v52.5.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.5.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.5.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.5.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.5.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.5.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.4.23
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.4.22
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.4.21
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.4.20
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.4.19
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.4.18
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.4.17
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.4.16
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.4.15
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.4.14
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.4.13
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.4.12
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.4.11
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.4.10
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.4.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.4.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v52.4.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v52.4.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v52.4.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v52.4.4
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atlassianartifactteam.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.4.3
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atlassianartifactteam.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.4.2
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atlassianartifactteam.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.4.1
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atlassianartifactteam.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.4.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atlassianartifactteam.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.3.2
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atlassianartifactteam.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.3.1
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atlassianartifactteam.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.3.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atlassianartifactteam.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.2.6
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atlassianartifactteam.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.2.5
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atlassianartifactteam.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.2.4
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atlassianartifactteam.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.2.3
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atlassianartifactteam.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.2.2
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atlassianartifactteam.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.2.1
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atlassianartifactteam.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.2.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atlassianartifactteam.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.1.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atlassianartifactteam.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.0.1
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atlassianartifactteam.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v52.0.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atlassianartifactteam.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v51.5.23
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atlassianartifactteam.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v51.5.22
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atlassianartifactteam.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v51.5.21
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atlassianartifactteam.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v51.5.20
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atlassianartifactteam.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v51.5.19
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atlassianartifactteam.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v51.5.18
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atlassianartifactteam.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v51.5.17
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atlassianartifactteam.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v51.5.16
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atlassianartifactteam.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v51.5.15
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atlassianartifactteam.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v51.5.14
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atlassianartifactteam.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v51.5.13
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atlassianartifactteam.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v51.5.12
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atlassianartifactteam.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v51.5.11
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atlassianartifactteam.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v51.5.10
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atlassianartifactteam.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v51.5.9
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atlassianartifactteam.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v51.5.8
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atlassianartifactteam.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v51.5.7
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atlassianartifactteam.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v51.5.6
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atlassianartifactteam.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v51.5.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v51.5.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v51.5.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.