@graphql-mesh/plugin-response-cache
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:new-function-constructor | AI (semgrep): Used to evaluate user-supplied config predicates (ifDef); documented pattern in graphql-mesh, not a malware indicator. | ai | |
| phantom-deps | phantom-dep:graphql-yoga | AI (phantom-deps): graphql-yoga is a declared runtime dep used transitively; phantom-dep heuristic is a false positive here. | ai | |
| phantom-deps | phantom-dep:@envelop/core | AI (phantom-deps): Same-ecosystem peer dep; phantom-dep heuristic false positive for this monorepo package. | ai | |
| phantom-deps | phantom-dep:@graphql-mesh/utils | AI (phantom-deps): Same org scope, declared dep; phantom-dep heuristic false positive. | ai |
Versions (showing 51 of 101)
| Version | Deps | Published |
|---|---|---|
| 0.104.45 | 12 / 0 | |
| 0.104.44 | 12 / 0 | |
| 0.104.43 | 12 / 0 | |
| 0.104.42 | 12 / 0 | |
| 0.104.41 | 12 / 0 | |
| 0.104.40 | 12 / 0 | |
| 0.104.39 | 12 / 0 | |
| 0.104.38 | 12 / 0 | |
| 0.104.37 | 12 / 0 | |
| 0.104.36 | 12 / 0 | |
| 0.104.35 | 12 / 0 | |
| 0.104.34 | 12 / 0 | |
| 0.104.33 | 12 / 0 | |
| 0.104.32 | 12 / 0 | |
| 0.104.30 | 12 / 0 | |
| 0.104.29 | 12 / 0 | |
| 0.104.28 | 12 / 0 | |
| 0.104.27 | 12 / 0 | |
| 0.104.26 | 12 / 0 | |
| 0.104.25 | 12 / 0 | |
| 0.104.24 | 12 / 0 | |
| 0.104.23 | 12 / 0 | |
| 0.104.22 | 12 / 0 | |
| 0.104.21 | 12 / 0 | |
| 0.104.20 | 12 / 0 | |
| 0.104.19 | 12 / 0 | |
| 0.104.18 | 12 / 0 | |
| 0.104.17 | 12 / 0 | |
| 0.104.16 | 12 / 0 | |
| 0.104.15 | 12 / 0 | |
| 0.104.14 | 12 / 0 | |
| 0.104.13 | 12 / 0 | |
| 0.104.12 | 12 / 0 | |
| 0.104.11 | 12 / 0 | |
| 0.104.10 | 12 / 0 | |
| 0.104.9 | 12 / 0 | |
| 0.104.8 | 12 / 0 | |
| 0.104.7 | 12 / 0 | |
| 0.104.6 | 12 / 0 | |
| 0.104.5 | 12 / 0 | |
| 0.104.4 | 12 / 0 | |
| 0.104.3 | 12 / 0 | |
| 0.104.2 | 12 / 0 | |
| 0.104.1 | 12 / 0 | |
| 0.104.0 | 12 / 0 | |
| 0.103.24 | 12 / 0 | |
| 0.103.23 | 12 / 0 | |
| 0.103.22 | 11 / 0 | |
| 0.103.21 | 11 / 0 | |
| 0.103.20 | 11 / 0 | |
| 0.103.19 | 11 / 0 |
v0.104.45
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.104.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.104.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.104.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.104.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.104.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.103.24
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.103.23
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.103.22
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.103.21
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.103.20
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.103.19
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.