@gapi/cli-builder
## Installation:
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | no-provenance | AI (provenance): Long-established package; lack of provenance is consistent across all 185 versions. | ai | |
| phantom-deps | phantom-dep:bufferutil | AI (phantom-deps): bufferutil is a declared runtime dep used by ws; phantom-dep heuristic fires but it's legitimately referenced. | ai |
Versions (showing 100 of 197)
| Version | Deps | Published |
|---|---|---|
| 1.8.234 | 7 / 5 | |
| 1.8.233 | 7 / 5 | |
| 1.8.232 | 7 / 5 | |
| 1.8.231 | 7 / 5 | |
| 1.8.230 | 7 / 5 | |
| 1.8.229 | 7 / 5 | |
| 1.8.228 | 7 / 5 | |
| 1.8.227 | 7 / 5 | |
| 1.8.226 | 7 / 5 | |
| 1.8.225 | 7 / 5 | |
| 1.8.224 | 7 / 5 | |
| 1.8.223 | 7 / 5 | |
| 1.8.222 | 7 / 5 | |
| 1.8.221 | 7 / 5 | |
| 1.8.220 | 7 / 5 | |
| 1.8.219 | 7 / 5 | |
| 1.8.218 | 7 / 5 | |
| 1.8.217 | 7 / 5 | |
| 1.8.216 | 7 / 5 | |
| 1.8.215 | 7 / 5 | |
| 1.8.214 | 7 / 5 | |
| 1.8.213 | 7 / 5 | |
| 1.8.212 | 7 / 5 | |
| 1.8.211 | 7 / 5 | |
| 1.8.210 | 7 / 5 | |
| 1.8.209 | 7 / 5 | |
| 1.8.208 | 7 / 5 | |
| 1.8.207 | 7 / 5 | |
| 1.8.206 | 7 / 5 | |
| 1.8.205 | 7 / 5 | |
| 1.8.204 | 7 / 5 | |
| 1.8.203 | 7 / 5 | |
| 1.8.202 | 7 / 5 | |
| 1.8.201 | 7 / 5 | |
| 1.8.200 | 7 / 5 | |
| 1.8.199 | 7 / 5 | |
| 1.8.198 | 7 / 5 | |
| 1.8.197 | 7 / 5 | |
| 1.8.196 | 7 / 5 | |
| 1.8.195 | 7 / 5 | |
| 1.8.194 | 7 / 5 | |
| 1.8.193 | 7 / 5 | |
| 1.8.192 | 7 / 5 | |
| 1.8.191 | 7 / 5 | |
| 1.8.190 | 7 / 5 | |
| 1.8.189 | 7 / 5 | |
| 1.8.188 | 7 / 5 | |
| 1.8.187 | 7 / 5 | |
| 1.8.186 | 7 / 5 | |
| 1.8.185 | 7 / 5 | |
| 1.8.184 | 7 / 5 | |
| 1.8.183 | 7 / 5 | |
| 1.8.182 | 7 / 5 | |
| 1.8.181 | 6 / 5 | |
| 1.8.180 | 6 / 5 | |
| 1.8.179 | 5 / 5 | |
| 1.8.178 | 5 / 5 | |
| 1.8.177 | 5 / 5 | |
| 1.8.176 | 5 / 5 | |
| 1.8.175 | 5 / 5 | |
| 1.8.174 | 5 / 5 | |
| 1.8.173 | 5 / 5 | |
| 1.8.172 | 5 / 5 | |
| 1.8.171 | 5 / 5 | |
| 1.8.170 | 5 / 5 | |
| 1.8.169 | 5 / 5 | |
| 1.8.168 | 5 / 5 | |
| 1.8.167 | 5 / 5 | |
| 1.8.166 | 5 / 5 | |
| 1.8.165 | 5 / 5 | |
| 1.8.164 | 5 / 5 | |
| 1.8.163 | 5 / 5 | |
| 1.8.162 | 5 / 5 | |
| 1.8.161 | 5 / 5 | |
| 1.8.160 | 5 / 5 | |
| 1.8.159 | 5 / 5 | |
| 1.8.158 | 5 / 5 | |
| 1.8.157 | 5 / 5 | |
| 1.8.156 | 5 / 5 | |
| 1.8.155 | 5 / 5 | |
| 1.8.154 | 5 / 5 | |
| 1.8.153 | 5 / 5 | |
| 1.8.152 | 5 / 5 | |
| 1.8.151 | 5 / 5 | |
| 1.8.150 | 5 / 5 | |
| 1.8.149 | 5 / 5 | |
| 1.8.148 | 5 / 5 | |
| 1.8.147 | 5 / 5 | |
| 1.8.146 | 5 / 5 | |
| 1.8.145 | 5 / 5 | |
| 1.8.144 | 5 / 5 | |
| 1.8.143 | 5 / 5 | |
| 1.8.142 | 5 / 5 | |
| 1.8.141 | 5 / 5 | |
| 1.8.140 | 5 / 5 | |
| 1.8.139 | 5 / 5 | |
| 1.8.138 | 5 / 5 | |
| 1.8.137 | 5 / 5 | |
| 1.8.136 | 5 / 5 | |
| 1.8.135 | 5 / 5 |
v1.8.234
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.8.151
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.150
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.149
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.148
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.147
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.146
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.145
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.144
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.143
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.142
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.141
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.140
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.139
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.138
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.137
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.136
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.135
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.