@galaxy-tool-util/gxwf-report-shell
Pre-built Vue 3 Galaxy workflow report components for CDN delivery
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:primevue | AI (dependencies): primevue is a well-established Vue 3 UI component library; stable false positive for this package. | ai | |
| npm-metadata | suspicious-initial-version | AI (npm-metadata): 0.0.0 is the initial release of a monorepo package under a legitimate org; not indicative of malice. | ai | |
| phantom-deps | phantom-dep:@galaxy-tool-util/schema | AI (phantom-deps): Same-org scoped package; declared as peer/runtime dep, not necessarily directly imported in source files. | ai |
Versions (showing 8 of 8)
| Version | Deps | Published |
|---|---|---|
| 1.7.1 | 4 / 3 | |
| 1.7.0 | 4 / 3 | |
| 1.6.0 | 4 / 3 | |
| 1.5.0 | 4 / 3 | |
| 1.2.0 | 4 / 3 | |
| 1.1.0 | 4 / 3 | |
| 0.4.0 | 4 / 3 | |
| 0.0.0 | 4 / 3 |
v1.7.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.7.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.6.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.5.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.2.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.1.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.