@backstage/plugin-notifications-backend-module-email
The email backend module for the notifications plugin.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:@aws-sdk/types | AI (phantom-deps): AWS SDK types loaded by convention in AWS integration module; stable pattern. | ai | |
| dependencies | unvetted-dep:@aws-sdk/client-sesv2 | AI (dependencies): AWS SES v2 SDK is a legitimate, well-known cloud email dependency; its use is expected for this email notification backend module. | ai | |
| dependencies | unvetted-dep:@azure/communication-email | AI (dependencies): Azure Communication Email SDK is a legitimate Microsoft Azure dependency; its use is expected for this email notification backend module. | ai | |
| phantom-deps | phantom-dep:@backstage/catalog-model | AI (phantom-deps): Same-org phantom dep in a monorepo package; @backstage/catalog-model is a legitimate sibling package and this is a non-issue for the Backstage ecosystem. | ai | |
| provenance | no-provenance | AI (provenance): Backstage monorepo packages historically lack Sigstore provenance; this is consistent across the ecosystem and not a meaningful risk signal for this package. | ai |
Versions (showing 31 of 31)
| Version | Deps | Published |
|---|---|---|
| 0.3.23 | 15 / 3 | |
| 0.3.22 | 15 / 3 | |
| 0.3.21 | 15 / 3 | |
| 0.3.20 | 15 / 3 | |
| 0.3.19 | 15 / 3 | |
| 0.3.18 | 15 / 3 | |
| 0.3.17 | 15 / 3 | |
| 0.3.16 | 15 / 3 | |
| 0.3.15 | 15 / 3 | |
| 0.3.14 | 15 / 3 | |
| 0.3.13 | 16 / 3 | |
| 0.3.12 | 16 / 3 | |
| 0.3.11 | 16 / 3 | |
| 0.3.10 | 16 / 3 | |
| 0.3.9 | 16 / 3 | |
| 0.3.8 | 16 / 3 | |
| 0.3.7 | 16 / 3 | |
| 0.3.6 | 16 / 3 | |
| 0.3.5 | 14 / 3 | |
| 0.3.4 | 14 / 3 | |
| 0.3.3 | 14 / 3 | |
| 0.3.2 | 15 / 3 | |
| 0.3.1 | 15 / 3 | |
| 0.3.0 | 15 / 3 | |
| 0.2.1 | 14 / 3 | |
| 0.2.0 | 14 / 3 | |
| 0.1.3 | 14 / 3 | |
| 0.1.2 | 14 / 3 | |
| 0.1.1 | 14 / 3 | |
| 0.1.0 | 14 / 3 | |
| 0.0.1 | 14 / 3 |
v0.3.23
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.