@finos/legend-application-query-bootstrap
Legend Query application bootstrap
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:react | AI (phantom-deps): Bootstrap package; react declared for consumers, not directly imported in source. | ai | |
| phantom-deps | phantom-dep:@types/react | AI (phantom-deps): Type-only peer dep; framework-scoped, stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@finos/legend-art | AI (phantom-deps): Same-org sibling dep in FINOS monorepo; stable false positive. | ai | |
| phantom-deps | phantom-dep:@finos/legend-lego | AI (phantom-deps): Same-org sibling dep in FINOS monorepo; stable false positive. | ai | |
| phantom-deps | phantom-dep:@finos/legend-graph | AI (phantom-deps): Same-org sibling dep in FINOS monorepo; stable false positive. | ai | |
| phantom-deps | phantom-dep:@finos/legend-application | AI (phantom-deps): Same-org sibling dep in FINOS monorepo; stable false positive. | ai | |
| provenance | no-provenance | AI (provenance): Established FINOS package; lack of Sigstore provenance is common and not a risk signal here. | ai |
Versions (showing 51 of 177)
| Version | Deps | Published |
|---|---|---|
| 13.228.0 | 16 / 7 | |
| 13.227.0 | 16 / 7 | |
| 13.225.0 | 16 / 7 | |
| 13.224.0 | 16 / 7 | |
| 13.223.0 | 16 / 7 | |
| 13.222.0 | 16 / 7 | |
| 13.221.0 | 16 / 7 | |
| 13.220.0 | 16 / 7 | |
| 13.219.0 | 16 / 7 | |
| 13.218.0 | 16 / 7 | |
| 13.217.0 | 16 / 7 | |
| 13.216.0 | 16 / 7 | |
| 13.215.0 | 16 / 7 | |
| 13.214.0 | 16 / 7 | |
| 13.213.0 | 16 / 7 | |
| 13.212.0 | 16 / 7 | |
| 13.211.0 | 16 / 7 | |
| 13.210.0 | 16 / 7 | |
| 13.209.0 | 16 / 7 | |
| 13.208.0 | 16 / 7 | |
| 13.207.0 | 16 / 7 | |
| 13.206.0 | 16 / 7 | |
| 13.205.0 | 16 / 7 | |
| 13.204.0 | 16 / 7 | |
| 13.203.0 | 16 / 7 | |
| 13.202.0 | 16 / 7 | |
| 13.201.0 | 16 / 7 | |
| 13.200.0 | 16 / 7 | |
| 13.199.0 | 16 / 7 | |
| 13.198.0 | 16 / 7 | |
| 13.197.0 | 16 / 7 | |
| 13.196.0 | 16 / 7 | |
| 13.195.0 | 16 / 7 | |
| 13.194.0 | 16 / 7 | |
| 13.193.0 | 16 / 7 | |
| 13.192.0 | 16 / 7 | |
| 13.191.0 | 16 / 7 | |
| 13.190.0 | 16 / 7 | |
| 13.189.0 | 16 / 7 | |
| 13.188.0 | 16 / 7 | |
| 13.187.0 | 16 / 7 | |
| 13.185.0 | 16 / 7 | |
| 13.184.0 | 16 / 7 | |
| 13.183.0 | 16 / 7 | |
| 13.182.0 | 16 / 7 | |
| 13.181.0 | 16 / 7 | |
| 13.180.0 | 16 / 7 | |
| 13.179.0 | 16 / 7 | |
| 13.178.0 | 16 / 7 | |
| 13.177.0 | 16 / 7 | |
| 13.176.0 | 16 / 7 |
v13.228.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.227.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.225.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.224.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.223.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.222.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.221.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.220.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.219.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.218.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.217.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.216.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.215.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.214.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.213.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.212.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.210.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.209.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v13.208.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v13.207.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v13.206.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v13.205.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.204.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.203.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.202.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.201.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.200.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.199.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.198.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.197.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.196.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.195.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.194.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.193.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.192.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.191.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.190.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.189.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.188.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.187.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.185.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.184.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.183.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.182.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.181.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.180.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.179.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.178.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.177.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.176.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.