← Home

@coveo/angular

npm

Coveo schematic for angular

8
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

aboissinotlcoolencoveo-organizationcoveoitolamothesssayeghylakhdaragong-coveondlrnpmcoveopixhelmmitichenlegrossallainmsriouxtalao-coveo

Keywords

schematicscoveoheadlessangular

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
maintainer-change maintainer-added AI (maintainer-change): Coveo org maintainer rotation, no code changes accompanying it. ai
maintainer-change maintainer-removed AI (maintainer-change): Consistent with employee turnover at Coveo, not a takeover pattern. ai
publish-pattern dormant-publish AI (publish-pattern): Long-running low-traffic internal tooling package; dormancy expected. ai
semgrep semgrep:child-process-import AI (semgrep): child_process used in search-token-server startup script; legitimate server management, stable for this package. ai
phantom-deps phantom-dep:@angular/cli AI (phantom-deps): @angular/cli is a schematics peer dependency loaded by convention, not directly imported. ai

Versions (showing 8 of 8)

Version Deps Published
1.36.16 7 / 14
1.36.15 7 / 14
1.36.14 7 / 14
1.36.13 7 / 14
1.36.12 7 / 14
1.36.11 7 / 14
1.36.10 7 / 14
1.36.9 7 / 14

v1.36.15

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.36.14

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.36.13

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.36.12

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.36.11

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.36.10

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.36.9

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.