@graphql-mesh/cli
51
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
urigodotansimhaardatanenisdenjotheguild-bot
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Transition to GitHub Actions CI publisher is confirmed by SLSA provenance attestation; stable pattern for this package going forward. | ai | |
| dependencies | unvetted-dep:@graphql-mesh/include | AI (dependencies): First-party @graphql-mesh monorepo package; stable pattern across all versions. | ai | |
| dependencies | unvetted-dep:@graphql-mesh/incontext-sdk-codegen | AI (dependencies): First-party @graphql-mesh monorepo package; stable pattern across all versions. | ai | |
| phantom-deps | phantom-dep:change-case | AI (phantom-deps): Used in codegen config context; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:graphql-tag | AI (phantom-deps): Peer/config-level dep for GraphQL tooling; stable false positive. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): Scoped package @graphql-mesh/cli; levenshtein match to 'joi' is a false positive with no plausible impersonation intent. | ai | |
| phantom-deps | phantom-dep:json-bigint-patch | AI (phantom-deps): Side-effect dep applied via import; stable false positive. | ai | |
| phantom-deps | phantom-dep:graphql-import-node | AI (phantom-deps): Side-effect/config dep; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:pascal-case | AI (phantom-deps): Codegen utility dep; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:mkdirp | AI (phantom-deps): CLI tooling dep used in build/config scripts, not a direct import; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:rimraf | AI (phantom-deps): CLI tooling dep used in build/config scripts; stable false positive. | ai |
Versions (showing 51 of 144)
| Version | Deps | Published |
|---|---|---|
| 0.100.54 | 34 / 0 | |
| 0.100.53 | 34 / 0 | |
| 0.100.52 | 34 / 0 | |
| 0.100.51 | 34 / 0 | |
| 0.100.50 | 34 / 0 | |
| 0.100.49 | 34 / 0 | |
| 0.100.48 | 34 / 0 | |
| 0.100.47 | 34 / 0 | |
| 0.100.46 | 34 / 0 | |
| 0.100.45 | 34 / 0 | |
| 0.100.44 | 34 / 0 | |
| 0.100.43 | 34 / 0 | |
| 0.100.42 | 34 / 0 | |
| 0.100.41 | 34 / 0 | |
| 0.100.40 | 34 / 0 | |
| 0.100.39 | 34 / 0 | |
| 0.100.38 | 34 / 0 | |
| 0.100.37 | 34 / 0 | |
| 0.100.36 | 34 / 0 | |
| 0.100.35 | 34 / 0 | |
| 0.100.34 | 33 / 0 | |
| 0.100.33 | 33 / 0 | |
| 0.100.32 | 33 / 0 | |
| 0.100.31 | 33 / 0 | |
| 0.100.30 | 33 / 0 | |
| 0.100.29 | 33 / 0 | |
| 0.100.28 | 33 / 0 | |
| 0.100.27 | 33 / 0 | |
| 0.100.26 | 33 / 0 | |
| 0.100.25 | 33 / 0 | |
| 0.100.24 | 33 / 0 | |
| 0.100.23 | 33 / 0 | |
| 0.100.22 | 33 / 0 | |
| 0.100.21 | 33 / 0 | |
| 0.100.20 | 33 / 0 | |
| 0.100.19 | 33 / 0 | |
| 0.100.18 | 33 / 0 | |
| 0.100.17 | 33 / 0 | |
| 0.100.16 | 33 / 0 | |
| 0.100.15 | 33 / 0 | |
| 0.100.14 | 33 / 0 | |
| 0.100.13 | 33 / 0 | |
| 0.100.12 | 33 / 0 | |
| 0.100.11 | 33 / 0 | |
| 0.100.10 | 33 / 0 | |
| 0.100.9 | 33 / 0 | |
| 0.100.8 | 33 / 0 | |
| 0.100.7 | 33 / 0 | |
| 0.100.6 | 33 / 0 | |
| 0.100.5 | 33 / 0 | |
| 0.100.4 | 33 / 0 |
v0.100.54
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.100.4
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.