@backstage/plugin-catalog-backend-module-gitlab
A Backstage catalog backend module that helps integrate towards GitLab
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@gitbeaker/rest | AI (dependencies): @gitbeaker/rest is the official GitLab API client, an expected and legitimate dependency for a GitLab catalog integration plugin. Stable accept for this package. | ai | |
| provenance | no-provenance | AI (provenance): Official Backstage monorepo package; provenance absence is common and not a risk signal for this well-established package. | ai | |
| phantom-deps | phantom-dep:@backstage/plugin-catalog-common | AI (phantom-deps): Same-org @backstage scope dependency; phantom detection is a false positive for bundled monorepo packages. | ai | |
| phantom-deps | phantom-dep:node-fetch | AI (phantom-deps): node-fetch is a legitimate declared dependency; phantom detection likely due to bundling or indirect import patterns. | ai | |
| phantom-deps | phantom-dep:@gitbeaker/rest | AI (phantom-deps): @gitbeaker/rest is a well-known GitLab API client; phantom detection likely due to bundling or indirect import patterns. | ai |
Versions (showing 51 of 58)
| Version | Deps | Published |
|---|---|---|
| 0.8.5 | 11 / 5 | |
| 0.8.4 | 11 / 5 | |
| 0.8.3 | 11 / 5 | |
| 0.8.2 | 13 / 5 | |
| 0.8.1 | 12 / 5 | |
| 0.8.0 | 12 / 5 | |
| 0.7.7 | 12 / 5 | |
| 0.7.6 | 12 / 5 | |
| 0.7.5 | 12 / 5 | |
| 0.7.4 | 12 / 5 | |
| 0.7.3 | 12 / 6 | |
| 0.7.2 | 12 / 6 | |
| 0.7.1 | 12 / 6 | |
| 0.7.0 | 12 / 6 | |
| 0.6.6 | 12 / 6 | |
| 0.6.5 | 12 / 6 | |
| 0.6.4 | 12 / 6 | |
| 0.6.3 | 12 / 6 | |
| 0.6.2 | 12 / 6 | |
| 0.6.1 | 12 / 6 | |
| 0.6.0 | 11 / 6 | |
| 0.5.0 | 12 / 6 | |
| 0.4.4 | 12 / 7 | |
| 0.4.3 | 12 / 7 | |
| 0.4.2 | 12 / 7 | |
| 0.4.1 | 12 / 7 | |
| 0.4.0 | 12 / 7 | |
| 0.3.21 | 13 / 7 | |
| 0.3.20 | 13 / 7 | |
| 0.3.19 | 13 / 7 | |
| 0.3.18 | 13 / 7 | |
| 0.3.17 | 13 / 7 | |
| 0.3.16 | 13 / 7 | |
| 0.3.15 | 10 / 6 | |
| 0.3.14 | 11 / 6 | |
| 0.3.13 | 11 / 6 | |
| 0.3.12 | 11 / 6 | |
| 0.3.11 | 11 / 6 | |
| 0.3.10 | 11 / 6 | |
| 0.3.9 | 11 / 6 | |
| 0.3.8 | 11 / 6 | |
| 0.3.7 | 11 / 6 | |
| 0.3.6 | 11 / 6 | |
| 0.3.5 | 11 / 6 | |
| 0.3.4 | 11 / 6 | |
| 0.3.3 | 11 / 6 | |
| 0.3.2 | 13 / 6 | |
| 0.3.1 | 13 / 6 | |
| 0.3.0 | 13 / 6 | |
| 0.2.6 | 13 / 6 | |
| 0.2.5 | 13 / 6 |
v0.8.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.6.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.6.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.6.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.6.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.6.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.6.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.21
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.20
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.19
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.18
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.17
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.3.16
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.3.15
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.14
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.13
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.12
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.11
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.10
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.