@camunda/camunda-composite-components
Camunda Composite Components
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | missing-githead | AI (provenance): Manual publish by known existing maintainer, no behavioral risk. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Consistent with legitimate Camunda team maintainer rotation. | ai |
Versions (showing 51 of 110)
| Version | Deps | Published |
|---|---|---|
| 0.25.4 | 4 / 32 | |
| 0.25.3 | 4 / 32 | |
| 0.25.2 | 4 / 32 | |
| 0.25.1 | 4 / 32 | |
| 0.25.0 | 4 / 32 | |
| 0.24.0 | 4 / 32 | |
| 0.23.4 | 4 / 32 | |
| 0.23.3 | 4 / 32 | |
| 0.23.2 | 4 / 32 | |
| 0.23.1 | 4 / 32 | |
| 0.23.0 | 4 / 32 | |
| 0.22.8 | 4 / 32 | |
| 0.22.7 | 4 / 32 | |
| 0.22.6 | 4 / 32 | |
| 0.22.5 | 4 / 32 | |
| 0.22.4 | 4 / 32 | |
| 0.22.3 | 4 / 32 | |
| 0.22.2 | 4 / 32 | |
| 0.22.1 | 4 / 32 | |
| 0.22.0 | 4 / 32 | |
| 0.21.5 | 4 / 32 | |
| 0.21.4 | 4 / 42 | |
| 0.21.3 | 4 / 42 | |
| 0.21.2 | 4 / 49 | |
| 0.21.1 | 4 / 52 | |
| 0.21.0 | 3 / 51 | |
| 0.20.9 | 3 / 51 | |
| 0.20.8 | 3 / 51 | |
| 0.20.7 | 3 / 51 | |
| 0.20.6 | 3 / 51 | |
| 0.20.5 | 3 / 51 | |
| 0.20.4 | 3 / 51 | |
| 0.20.3 | 3 / 51 | |
| 0.20.2 | 3 / 59 | |
| 0.20.1 | 3 / 59 | |
| 0.20.0 | 3 / 59 | |
| 0.19.1 | 3 / 59 | |
| 0.19.0 | 3 / 59 | |
| 0.18.1 | 3 / 59 | |
| 0.18.0 | 3 / 59 | |
| 0.17.1 | 3 / 59 | |
| 0.17.0 | 3 / 62 | |
| 0.16.0 | 3 / 62 | |
| 0.15.1 | 3 / 62 | |
| 0.15.0 | 3 / 62 | |
| 0.14.0 | 3 / 62 | |
| 0.13.0 | 3 / 62 | |
| 0.12.0 | 3 / 62 | |
| 0.11.0 | 3 / 62 | |
| 0.10.0 | 3 / 62 | |
| 0.9.0 | 3 / 62 |
v0.25.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.25.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.25.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.22.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.22.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.18.1
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: urbanisierung.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (urbanisierung) than the most recent previously approved version (vsgoulart) on 2025-04-01, but urbanisierung is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.18.0
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: urbanisierung.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (urbanisierung) than the most recent previously approved version (vsgoulart) on 2025-03-25, but urbanisierung is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.17.1
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: urbanisierung.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (urbanisierung) than the most recent previously approved version (vsgoulart) on 2025-03-12, but urbanisierung is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.17.0
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: urbanisierung.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (urbanisierung) than the most recent previously approved version (vsgoulart) on 2025-02-24, but urbanisierung is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.16.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.15.1
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: urbanisierung.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (urbanisierung) than the most recent previously approved version (vsgoulart) on 2025-01-24, but urbanisierung is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.15.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.14.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.13.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.12.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.11.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.10.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.9.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.