@graphql-mesh/runtime
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:@graphql-mesh/utils | AI (phantom-deps): Same-org sibling package, expected dependency. | ai | |
| phantom-deps | phantom-dep:ts-node | AI (phantom-deps): Build-time dep, false positive pattern for this package. | ai | |
| phantom-deps | phantom-dep:@graphql-mesh/extend | AI (phantom-deps): Same-org monorepo sibling, expected dependency. | ai | |
| phantom-deps | phantom-dep:apollo-server | AI (phantom-deps): Peer/optional integration dep for this GraphQL package. | ai | |
| phantom-deps | phantom-dep:winston | AI (phantom-deps): Common logging dep, false-positive prone on compiled output. | ai | |
| phantom-deps | phantom-dep:js-yaml | AI (phantom-deps): Common config-parsing dep, false-positive prone on compiled output. | ai | |
| phantom-deps | phantom-dep:mkdirp | AI (phantom-deps): Common utility dep, false-positive prone on compiled output. | ai | |
| phantom-deps | phantom-dep:yargs | AI (phantom-deps): Common CLI dep, false-positive prone on compiled output. | ai | |
| phantom-deps | phantom-dep:chalk | AI (phantom-deps): Common utility dep, false-positive prone on compiled output. | ai | |
| phantom-deps | phantom-dep:@graphql-mesh/rename | AI (phantom-deps): Same-org monorepo sibling, expected dependency. | ai | |
| phantom-deps | phantom-dep:@graphql-mesh/prefix | AI (phantom-deps): Same-org monorepo sibling, expected dependency. | ai | |
| phantom-deps | phantom-dep:tsee | AI (phantom-deps): Declared dep likely used via bundled/minified output, not malicious. | ai | |
| phantom-deps | phantom-dep:@graphql-toolkit/schema-merging | AI (phantom-deps): Likely used in bundled/minified output; not a real risk signal here. | ai | |
| phantom-deps | phantom-dep:@graphql-tools/merge | AI (phantom-deps): Core graphql-tools dep likely used via dynamic import/bundling. | ai | |
| phantom-deps | phantom-dep:@envelop/live-query | AI (phantom-deps): Likely used via bundled dist output; benign for this monorepo package. | ai | |
| phantom-deps | phantom-dep:@graphql-tools/wrap | AI (phantom-deps): Likely used via type re-exports in a monorepo package; benign for this ecosystem. | ai | |
| phantom-deps | phantom-dep:@graphql-tools/schema | AI (phantom-deps): Likely used via bundled/dual build output; established monorepo package. | ai | |
| phantom-deps | phantom-dep:@graphql-tools/resolvers-composition | AI (phantom-deps): Likely used via bundled/dual build output; established monorepo package. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): Known implicit runtime dependency. | ai | |
| phantom-deps | phantom-dep:@n1ru4l/graphql-live-query | AI (phantom-deps): Likely used via bundled/dual build output; established monorepo package. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Module-loader pattern trying alternate parser packages; consistent with graphql-mesh's plugin architecture. | ai | |
| phantom-deps | phantom-dep:aggregate-error | AI (phantom-deps): Bundled cjs output obscures imports; likely used internally. | ai | |
| phantom-deps | phantom-dep:@graphql-tools/stitch | AI (phantom-deps): Bundled cjs output obscures imports; likely used internally. | ai | |
| phantom-deps | phantom-dep:@graphql-mesh/merger-stitching | AI (phantom-deps): Same-org dep, bundler hides direct import. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): New deps are first-party graphql-tools/graphql-jit ecosystem packages. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Feature-detection snippet (`new Function('return true')`), not code execution of external input. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): enisdenjo and theguild-bot are known graphql-mesh org maintainers; legitimate org-level change. | ai | |
| provenance | publisher-changed | AI (provenance): Org migrated to GitHub Actions CI publishing with SLSA attestation; stable pattern for this package going forward. | ai | |
| phantom-deps | phantom-dep:@envelop/graphql-jit | AI (phantom-deps): Plugin dep referenced in config files, not directly imported; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:graphql-jit | AI (phantom-deps): graphql-jit is a peer/optional runtime dep referenced in config; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@graphql-tools/batch-delegate | AI (phantom-deps): Ecosystem dep referenced in config; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@envelop/extended-validation | AI (phantom-deps): Plugin dep referenced in config; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@graphql-tools/delegate | AI (phantom-deps): Ecosystem dep referenced in config; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@graphql-mesh/string-interpolation | AI (phantom-deps): Same-org sibling package in graphql-mesh monorepo; phantom-dep heuristic is a stable false positive here. | ai |
Versions (showing 100 of 457)
| Version | Deps | Published |
|---|---|---|
| 0.25.0 | 10 / 0 | |
| 0.24.1 | 10 / 0 | |
| 0.24.0 | 10 / 0 | |
| 0.23.1 | 10 / 0 | |
| 0.23.0 | 10 / 0 | |
| 0.22.0 | 10 / 0 | |
| 0.21.2 | 10 / 0 | |
| 0.21.1 | 10 / 0 | |
| 0.21.0 | 10 / 0 | |
| 0.20.2 | 10 / 0 | |
| 0.20.1 | 10 / 0 | |
| 0.20.0 | 10 / 0 | |
| 0.19.1 | 10 / 0 | |
| 0.19.0 | 10 / 0 | |
| 0.18.7 | 10 / 0 | |
| 0.18.6 | 10 / 0 | |
| 0.18.5 | 10 / 0 | |
| 0.18.4 | 10 / 0 | |
| 0.18.3 | 10 / 0 | |
| 0.18.2 | 10 / 0 | |
| 0.18.1 | 10 / 0 | |
| 0.18.0 | 10 / 0 | |
| 0.17.1 | 10 / 0 | |
| 0.17.0 | 9 / 0 | |
| 0.16.6 | 9 / 0 | |
| 0.16.5 | 9 / 0 | |
| 0.16.4 | 9 / 0 | |
| 0.16.3 | 9 / 0 | |
| 0.16.2 | 9 / 0 | |
| 0.16.1 | 9 / 0 | |
| 0.16.0 | 9 / 0 | |
| 0.15.0 | 9 / 0 | |
| 0.14.1 | 9 / 0 | |
| 0.14.0 | 9 / 0 | |
| 0.13.4 | 10 / 0 | |
| 0.13.3 | 10 / 0 | |
| 0.13.2 | 9 / 0 | |
| 0.13.1 | 9 / 0 | |
| 0.12.0 | 9 / 0 | |
| 0.11.9 | 9 / 0 | |
| 0.11.8 | 9 / 0 | |
| 0.11.7 | 9 / 0 | |
| 0.11.6 | 9 / 0 | |
| 0.11.5 | 9 / 0 | |
| 0.11.4 | 9 / 0 | |
| 0.11.3 | 9 / 0 | |
| 0.11.2 | 9 / 0 | |
| 0.11.1 | 9 / 0 | |
| 0.11.0 | 9 / 0 | |
| 0.10.26 | 7 / 0 | |
| 0.10.25 | 7 / 0 | |
| 0.10.24 | 7 / 0 | |
| 0.10.23 | 7 / 0 | |
| 0.10.22 | 7 / 0 | |
| 0.10.21 | 7 / 0 | |
| 0.10.20 | 7 / 0 | |
| 0.10.19 | 7 / 0 | |
| 0.10.18 | 7 / 0 | |
| 0.10.17 | 7 / 0 | |
| 0.10.16 | 7 / 0 | |
| 0.10.15 | 7 / 0 | |
| 0.10.14 | 7 / 0 | |
| 0.10.13 | 7 / 0 | |
| 0.10.12 | 7 / 0 | |
| 0.10.11 | 7 / 0 | |
| 0.10.10 | 7 / 0 | |
| 0.10.9 | 7 / 0 | |
| 0.10.8 | 7 / 0 | |
| 0.10.7 | 7 / 0 | |
| 0.10.6 | 7 / 0 | |
| 0.10.5 | 7 / 0 | |
| 0.10.4 | 7 / 0 | |
| 0.10.3 | 7 / 0 | |
| 0.10.2 | 7 / 0 | |
| 0.10.1 | 7 / 0 | |
| 0.10.0 | 7 / 0 | |
| 0.9.0 | 7 / 0 | |
| 0.8.0 | 7 / 0 | |
| 0.7.15 | 7 / 0 | |
| 0.7.14 | 7 / 0 | |
| 0.7.13 | 7 / 0 | |
| 0.7.12 | 7 / 0 | |
| 0.7.11 | 7 / 0 | |
| 0.7.10 | 7 / 0 | |
| 0.7.9 | 7 / 0 | |
| 0.7.8 | 7 / 0 | |
| 0.7.7 | 7 / 0 | |
| 0.7.6 | 7 / 0 | |
| 0.7.5 | 7 / 0 | |
| 0.7.4 | 7 / 0 | |
| 0.7.3 | 7 / 0 | |
| 0.7.2 | 7 / 0 | |
| 0.7.1 | 7 / 0 | |
| 0.7.0 | 7 / 0 | |
| 0.6.5 | 7 / 0 | |
| 0.6.4 | 7 / 0 | |
| 0.6.3 | 7 / 0 | |
| 0.6.2 | 7 / 0 | |
| 0.6.1 | 7 / 0 | |
| 0.6.0 | 7 / 0 |
v0.25.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.24.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.24.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.23.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.23.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.22.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.21.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.21.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.21.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.20.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.20.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.20.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.19.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.19.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.18.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.18.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.18.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.18.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.18.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.18.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.18.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.18.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.16.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.16.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.16.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.16.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.16.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.16.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.16.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.15.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.14.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.14.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.13.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.13.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.13.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.13.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.12.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.11.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.11.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.11.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.11.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.11.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.11.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.11.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.11.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.11.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.11.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.10.26
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.10.25
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.10.24
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.10.23
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.10.22
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.10.21
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.10.20
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.10.19
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.10.18
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.10.17
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.10.16
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.10.15
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.10.14
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.10.13
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.10.12
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.10.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.10.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.10.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.10.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.10.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.10.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.10.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.10.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.10.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.10.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.10.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.10.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.9.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.8.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.7.15
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.7.14
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.7.13
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.7.12
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.7.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.7.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.7.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.7.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.7.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.7.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.7.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.7.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.7.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.7.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.7.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.7.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.6.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.6.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.6.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.6.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.6.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.6.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.