@coinbase/cds-common
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| bogus-package | bogus-package | AI (bogus-package): Internal Coinbase DS component; sparse README and no keywords are expected for monorepo sub-packages. | ai | |
| phantom-deps | phantom-dep:zod | AI (phantom-deps): Type-only or config-level usage in a TS monorepo package; stable false positive. | ai | |
| phantom-deps | phantom-dep:type-fest | AI (phantom-deps): Type-only usage; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:d3-interpolate | AI (phantom-deps): Re-exported or transitively used; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@coinbase/cds-mcp-server | AI (phantom-deps): Same-org sibling; phantom-dep heuristic unreliable for monorepo cross-package references. | ai | |
| phantom-deps | phantom-dep:@modelcontextprotocol/sdk | AI (phantom-deps): Used via cds-mcp-server integration; stable false positive for this package. | ai |
Versions (showing 100 of 183)
| Version | Deps | Published |
|---|---|---|
| 9.8.0 | 14 / 8 | |
| 9.7.2 | 14 / 8 | |
| 9.7.1 | 14 / 8 | |
| 9.7.0 | 14 / 8 | |
| 9.6.11 | 14 / 8 | |
| 9.6.10 | 14 / 8 | |
| 9.6.9 | 14 / 8 | |
| 9.6.8 | 14 / 8 | |
| 9.6.7 | 14 / 8 | |
| 9.6.6 | 14 / 8 | |
| 9.6.5 | 14 / 8 | |
| 9.6.4 | 14 / 8 | |
| 9.6.3 | 14 / 8 | |
| 9.6.2 | 14 / 8 | |
| 9.6.1 | 14 / 8 | |
| 9.6.0 | 14 / 8 | |
| 9.5.0 | 14 / 8 | |
| 9.4.3 | 14 / 8 | |
| 9.4.2 | 14 / 8 | |
| 9.4.1 | 14 / 8 | |
| 9.4.0 | 14 / 8 | |
| 9.3.1 | 14 / 8 | |
| 9.3.0 | 14 / 8 | |
| 9.2.2 | 14 / 8 | |
| 9.2.1 | 14 / 8 | |
| 9.2.0 | 14 / 8 | |
| 9.1.3 | 14 / 8 | |
| 9.1.2 | 14 / 8 | |
| 9.1.1 | 14 / 8 | |
| 9.1.0 | 14 / 8 | |
| 9.0.2 | 14 / 8 | |
| 9.0.1 | 14 / 8 | |
| 9.0.0 | 14 / 8 | |
| 8.75.4 | 14 / 6 | |
| 8.75.3 | 14 / 6 | |
| 8.75.2 | 14 / 6 | |
| 8.75.1 | 14 / 6 | |
| 8.75.0 | 14 / 6 | |
| 8.74.3 | 14 / 6 | |
| 8.74.2 | 14 / 6 | |
| 8.74.1 | 14 / 6 | |
| 8.74.0 | 14 / 6 | |
| 8.73.0 | 14 / 6 | |
| 8.72.0 | 14 / 6 | |
| 8.71.0 | 14 / 6 | |
| 8.70.0 | 14 / 6 | |
| 8.69.1 | 14 / 6 | |
| 8.69.0 | 14 / 6 | |
| 8.68.0 | 14 / 6 | |
| 8.67.0 | 14 / 6 | |
| 8.66.2 | 14 / 6 | |
| 8.66.1 | 14 / 6 | |
| 8.66.0 | 14 / 6 | |
| 8.62.1 | 14 / 6 | |
| 8.62.0 | 14 / 6 | |
| 8.61.0 | 14 / 6 | |
| 8.60.0 | 14 / 6 | |
| 8.59.0 | 14 / 6 | |
| 8.58.0 | 14 / 6 | |
| 8.57.1 | 14 / 6 | |
| 8.57.0 | 14 / 6 | |
| 8.56.1 | 14 / 6 | |
| 8.56.0 | 14 / 6 | |
| 8.55.1 | 14 / 6 | |
| 8.55.0 | 14 / 6 | |
| 8.54.0 | 14 / 6 | |
| 8.53.1 | 14 / 6 | |
| 8.53.0 | 14 / 6 | |
| 8.52.2 | 14 / 6 | |
| 8.52.1 | 14 / 6 | |
| 8.52.0 | 14 / 6 | |
| 8.51.0 | 14 / 6 | |
| 8.50.0 | 14 / 6 | |
| 8.49.2 | 14 / 6 | |
| 8.49.1 | 14 / 6 | |
| 8.49.0 | 14 / 6 | |
| 8.48.3 | 14 / 6 | |
| 8.48.2 | 14 / 6 | |
| 8.48.1 | 14 / 6 | |
| 8.48.0 | 14 / 6 | |
| 8.47.4 | 14 / 6 | |
| 8.47.3 | 14 / 6 | |
| 8.47.2 | 14 / 6 | |
| 8.47.1 | 14 / 6 | |
| 8.47.0 | 14 / 6 | |
| 8.46.1 | 14 / 6 | |
| 8.46.0 | 14 / 6 | |
| 8.45.0 | 14 / 6 | |
| 8.44.2 | 14 / 6 | |
| 8.44.1 | 14 / 6 | |
| 8.44.0 | 14 / 6 | |
| 8.43.2 | 14 / 6 | |
| 8.43.0 | 14 / 6 | |
| 8.42.0 | 14 / 6 | |
| 8.41.0 | 14 / 6 | |
| 8.40.2 | 14 / 6 | |
| 8.40.1 | 14 / 6 | |
| 8.40.0 | 14 / 6 | |
| 8.39.1 | 14 / 6 | |
| 8.39.0 | 14 / 6 |
v9.8.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v9.7.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v9.7.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v9.7.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v9.6.11
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v9.6.10
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v9.6.9
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v9.6.8
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v9.6.7
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v9.6.6
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v9.6.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v9.6.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v9.6.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v9.6.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v9.6.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v9.6.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.