@bts-soft/notifications
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): handlebars addition is benign and contextually appropriate for this package's email templating use case. | ai | |
| dependencies | unvetted-dep:handlebars | AI (dependencies): Handlebars is a mainstream templating library; appropriate for a notifications/email module. | ai | |
| phantom-deps | phantom-dep:ts-node | AI (phantom-deps): Build/runtime tool dependency for NestJS; not directly imported but used by convention. | ai | |
| phantom-deps | phantom-dep:typescript | AI (phantom-deps): Compiler dependency; not directly imported but required for build. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): require() loads a user-configured service account file path — standard Firebase Admin SDK pattern, not arbitrary module loading. | ai | |
| phantom-deps | phantom-dep:@nestjs/core | AI (phantom-deps): NestJS peer dependency loaded by framework convention, not direct import. | ai | |
| phantom-deps | phantom-dep:@nestjs/config | AI (phantom-deps): NestJS peer dependency loaded by framework convention, not direct import. | ai | |
| phantom-deps | phantom-dep:@types/node-telegram-bot-api | AI (phantom-deps): Type-only package; not directly imported at runtime by design. | ai | |
| source-diff | large-new-source-files | AI (source-diff): 50 new files consistent with added test suite and feature expansion; no obfuscation or injected code indicators. | ai | |
| dependencies | unvetted-dep:node-telegram-bot-api | AI (dependencies): Legitimate Telegram bot library; expected dependency for a notifications module with Telegram support. | ai | |
| dependencies | unvetted-dep:typeorm-transactional | AI (dependencies): Well-known TypeORM transaction helper; expected for a NestJS module using TypeORM. | ai |
Versions (showing 51 of 53)
| Version | Deps | Published |
|---|---|---|
| 1.8.0 | 20 / 15 | |
| 1.7.9 | 19 / 15 | |
| 1.7.8 | 18 / 15 | |
| 1.7.7 | 17 / 15 | |
| 1.7.0 | 17 / 15 | |
| 1.6.9 | 16 / 14 | |
| 1.6.8 | 15 / 14 | |
| 1.6.6 | 14 / 14 | |
| 1.6.5 | 14 / 14 | |
| 1.6.4 | 14 / 14 | |
| 1.6.3 | 14 / 14 | |
| 1.6.2 | 14 / 14 | |
| 1.6.1 | 14 / 14 | |
| 1.5.1 | 14 / 13 | |
| 1.5.0 | 14 / 13 | |
| 1.4.9 | 14 / 9 | |
| 1.4.8 | 14 / 9 | |
| 1.4.7 | 16 / 9 | |
| 1.4.6 | 15 / 8 | |
| 1.4.5 | 15 / 8 | |
| 1.4.4 | 15 / 8 | |
| 1.4.2 | 17 / 5 | |
| 1.4.1 | 15 / 5 | |
| 1.4.0 | 15 / 5 | |
| 1.3.9 | 15 / 5 | |
| 1.3.8 | 15 / 5 | |
| 1.3.7 | 16 / 5 | |
| 1.3.6 | 16 / 5 | |
| 1.3.5 | 16 / 5 | |
| 1.3.4 | 15 / 5 | |
| 1.3.3 | 14 / 5 | |
| 1.3.2 | 14 / 5 | |
| 1.3.1 | 14 / 5 | |
| 1.3.0 | 13 / 4 | |
| 1.2.9 | 13 / 4 | |
| 1.2.8 | 13 / 4 | |
| 1.2.7 | 13 / 4 | |
| 1.2.6 | 13 / 3 | |
| 1.2.5 | 13 / 3 | |
| 1.2.4 | 13 / 3 | |
| 1.1.4 | 12 / 2 | |
| 1.1.3 | 12 / 2 | |
| 1.1.2 | 12 / 2 | |
| 1.1.1 | 12 / 2 | |
| 1.1.0 | 12 / 2 | |
| 1.0.9 | 12 / 2 | |
| 1.0.8 | 12 / 2 | |
| 1.0.7 | 7 / 2 | |
| 1.0.6 | 7 / 2 | |
| 1.0.4 | 7 / 2 | |
| 1.0.3 | 7 / 2 |
v1.8.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.7.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.7.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.7.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.7.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.