@google-cloud/pubsub
23
Versions
—
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
google-wombot
Keywords
google apis clientgoogle api clientgoogle apisgoogle apigooglegoogle cloud platformgoogle cloudcloudgoogle pubsubpubsub
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | no-provenance | AI (provenance): google-wombot is Google's official publishing bot; lack of Sigstore provenance is expected for this publisher and does not indicate risk. | ai | |
| phantom-deps | phantom-dep:@types/duplexify | AI (phantom-deps): @types/duplexify is a TypeScript type package used as a runtime dep in Google Cloud libraries for type compatibility; this is a stable pattern for this package. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): google-wombot is Google's official publishing bot with a strong track record; major version bumps (v3→v4) can appear as dormancy gaps. Not indicative of account takeover. | ai | |
| phantom-deps | phantom-dep:@types/long | AI (phantom-deps): @types/long is a TypeScript type package used as a runtime dep in Google Cloud libraries for type compatibility; this is a stable pattern for this package. | ai | |
| dependencies | unvetted-dep:google-gax | AI (dependencies): google-gax is Google's own gRPC/API client framework, a core dependency of all Google Cloud Node.js client libraries. Stable and expected for this package. | ai | |
| dependencies | unvetted-dep:@google-cloud/precise-date | AI (dependencies): @google-cloud/precise-date is a Google Cloud utility package, a standard dependency for this library across versions. | ai | |
| dependencies | unvetted-dep:heap-js | AI (dependencies): heap-js is a well-known data structure library used for message ordering in pubsub; legitimate and expected dependency. | ai | |
| phantom-deps | phantom-dep:@opentelemetry/semantic-conventions | AI (phantom-deps): @opentelemetry/semantic-conventions is a legitimate runtime dep used for OpenTelemetry tracing integration; the phantom-dep finding is a false positive for this package. | ai |
Versions (showing 23 of 23)
| Version | Deps | Published |
|---|---|---|
| 5.3.1 | 17 / 36 | |
| 5.3.0 | 15 / 39 | |
| 5.2.4 | 15 / 39 | |
| 5.2.3 | 15 / 39 | |
| 5.2.2 | 15 / 39 | |
| 5.2.1 | 15 / 39 | |
| 5.2.0 | 15 / 39 | |
| 5.1.0 | 15 / 39 | |
| 5.0.0 | 14 / 40 | |
| 4.11.0 | 14 / 40 | |
| 4.10.0 | 14 / 40 | |
| 4.9.0 | 14 / 40 | |
| 4.8.0 | 14 / 40 | |
| 4.7.2 | 14 / 39 | |
| 4.7.1 | 14 / 37 | |
| 4.7.0 | 14 / 37 | |
| 4.6.0 | 14 / 36 | |
| 4.5.0 | 14 / 36 | |
| 4.4.1 | 14 / 36 | |
| 4.4.0 | 14 / 36 | |
| 4.2.0 | 16 / 36 | |
| 4.0.3 | 16 / 36 | |
| 3.7.3 | 16 / 35 |