@graphql-codegen/schema-ast
GraphQL Code Generator plugin for generating a .graphql file from a given schema
51
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
dotansimhaardatankamilkisielaurigotheguild-bot
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | no-provenance | AI (provenance): Established package with strong ecosystem trust; lack of provenance is a minor hygiene issue, not a security risk for this publisher. | ai | |
| provenance | publisher-changed | AI (provenance): theguild-bot is The Guild's automation account, the recognized steward of graphql-code-generator. This is a documented org-level transition from dotansimha, not a suspicious takeover. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): theguild-bot is The Guild's automation account with 4521 approved packages and 0 rejected; addition is part of a legitimate organizational handoff. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Removal of darkbasic is consistent with The Guild taking over stewardship of the graphql-code-generator monorepo from original maintainers. | ai | |
| dependencies | unvetted-dep:@graphql-codegen/plugin-helpers | AI (dependencies): Sibling package within the same graphql-code-generator monorepo, published by the same trusted theguild-bot publisher. Stable false positive for this package. | ai | |
| provenance | missing-githead | AI (provenance): Established package from a highly trusted publisher (dotansimha); missing gitHead reflects a publish environment change, not a security concern for this package. | ai | |
| phantom-deps | phantom-dep:@graphql-tools/utils | AI (phantom-deps): @graphql-tools/utils is a well-known GraphQL utilities package declared as a dependency; referenced in config files is expected for a codegen plugin. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): tslib is a known implicit runtime dependency for TypeScript-compiled packages; stable false positive for this package. | ai |
Versions (showing 51 of 84)
| Version | Deps | Published |
|---|---|---|
| 6.1.0 | 3 / 0 | |
| 6.0.1 | 3 / 0 | |
| 6.0.0 | 3 / 0 | |
| 5.0.2 | 3 / 0 | |
| 5.0.1 | 3 / 0 | |
| 5.0.0 | 3 / 0 | |
| 4.1.0 | 3 / 0 | |
| 4.0.2 | 3 / 0 | |
| 4.0.1 | 3 / 0 | |
| 4.0.0 | 3 / 0 | |
| 3.0.1 | 3 / 0 | |
| 3.0.0 | 3 / 0 | |
| 2.6.1 | 3 / 0 | |
| 2.6.0 | 3 / 0 | |
| 2.5.2 | 3 / 0 | |
| 2.5.1 | 3 / 0 | |
| 2.5.0 | 3 / 0 | |
| 2.4.1 | 3 / 0 | |
| 2.4.0 | 3 / 0 | |
| 2.3.0 | 3 / 0 | |
| 2.2.0 | 3 / 0 | |
| 2.1.0 | 3 / 0 | |
| 2.0.0 | 3 / 0 | |
| 1.18.3 | 3 / 0 | |
| 1.18.2 | 3 / 0 | |
| 1.18.1 | 3 / 0 | |
| 1.18.0 | 3 / 0 | |
| 1.17.8 | 3 / 0 | |
| 1.17.7 | 3 / 0 | |
| 1.17.6 | 3 / 0 | |
| 1.17.5 | 3 / 0 | |
| 1.17.4 | 3 / 0 | |
| 1.17.3 | 3 / 0 | |
| 1.17.1 | 3 / 0 | |
| 1.17.0 | 3 / 0 | |
| 1.16.3 | 3 / 0 | |
| 1.16.2 | 3 / 0 | |
| 1.16.1 | 3 / 0 | |
| 1.16.0 | 3 / 0 | |
| 1.15.4 | 3 / 0 | |
| 1.15.3 | 3 / 0 | |
| 1.15.2 | 3 / 0 | |
| 1.15.1 | 3 / 0 | |
| 1.15.0 | 3 / 0 | |
| 1.14.0 | 3 / 0 | |
| 1.13.5 | 3 / 0 | |
| 1.13.4 | 3 / 0 | |
| 1.13.3 | 3 / 0 | |
| 1.13.2 | 3 / 0 | |
| 1.13.1 | 3 / 0 | |
| 1.13.0 | 3 / 0 |
v6.1.0
2 findings
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
INFO
Missing gitHead — previous versions had it
provenance
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.