@graphql-mesh/runtime
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:@graphql-mesh/utils | AI (phantom-deps): Same-org sibling package, expected dependency. | ai | |
| phantom-deps | phantom-dep:ts-node | AI (phantom-deps): Build-time dep, false positive pattern for this package. | ai | |
| phantom-deps | phantom-dep:@graphql-mesh/extend | AI (phantom-deps): Same-org monorepo sibling, expected dependency. | ai | |
| phantom-deps | phantom-dep:apollo-server | AI (phantom-deps): Peer/optional integration dep for this GraphQL package. | ai | |
| phantom-deps | phantom-dep:winston | AI (phantom-deps): Common logging dep, false-positive prone on compiled output. | ai | |
| phantom-deps | phantom-dep:js-yaml | AI (phantom-deps): Common config-parsing dep, false-positive prone on compiled output. | ai | |
| phantom-deps | phantom-dep:mkdirp | AI (phantom-deps): Common utility dep, false-positive prone on compiled output. | ai | |
| phantom-deps | phantom-dep:yargs | AI (phantom-deps): Common CLI dep, false-positive prone on compiled output. | ai | |
| phantom-deps | phantom-dep:chalk | AI (phantom-deps): Common utility dep, false-positive prone on compiled output. | ai | |
| phantom-deps | phantom-dep:@graphql-mesh/rename | AI (phantom-deps): Same-org monorepo sibling, expected dependency. | ai | |
| phantom-deps | phantom-dep:@graphql-mesh/prefix | AI (phantom-deps): Same-org monorepo sibling, expected dependency. | ai | |
| phantom-deps | phantom-dep:tsee | AI (phantom-deps): Declared dep likely used via bundled/minified output, not malicious. | ai | |
| phantom-deps | phantom-dep:@graphql-toolkit/schema-merging | AI (phantom-deps): Likely used in bundled/minified output; not a real risk signal here. | ai | |
| phantom-deps | phantom-dep:@graphql-tools/merge | AI (phantom-deps): Core graphql-tools dep likely used via dynamic import/bundling. | ai | |
| phantom-deps | phantom-dep:@envelop/live-query | AI (phantom-deps): Likely used via bundled dist output; benign for this monorepo package. | ai | |
| phantom-deps | phantom-dep:@graphql-tools/wrap | AI (phantom-deps): Likely used via type re-exports in a monorepo package; benign for this ecosystem. | ai | |
| phantom-deps | phantom-dep:@graphql-tools/schema | AI (phantom-deps): Likely used via bundled/dual build output; established monorepo package. | ai | |
| phantom-deps | phantom-dep:@graphql-tools/resolvers-composition | AI (phantom-deps): Likely used via bundled/dual build output; established monorepo package. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): Known implicit runtime dependency. | ai | |
| phantom-deps | phantom-dep:@n1ru4l/graphql-live-query | AI (phantom-deps): Likely used via bundled/dual build output; established monorepo package. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Module-loader pattern trying alternate parser packages; consistent with graphql-mesh's plugin architecture. | ai | |
| phantom-deps | phantom-dep:aggregate-error | AI (phantom-deps): Bundled cjs output obscures imports; likely used internally. | ai | |
| phantom-deps | phantom-dep:@graphql-tools/stitch | AI (phantom-deps): Bundled cjs output obscures imports; likely used internally. | ai | |
| phantom-deps | phantom-dep:@graphql-mesh/merger-stitching | AI (phantom-deps): Same-org dep, bundler hides direct import. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): New deps are first-party graphql-tools/graphql-jit ecosystem packages. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Feature-detection snippet (`new Function('return true')`), not code execution of external input. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): enisdenjo and theguild-bot are known graphql-mesh org maintainers; legitimate org-level change. | ai | |
| provenance | publisher-changed | AI (provenance): Org migrated to GitHub Actions CI publishing with SLSA attestation; stable pattern for this package going forward. | ai | |
| phantom-deps | phantom-dep:@envelop/graphql-jit | AI (phantom-deps): Plugin dep referenced in config files, not directly imported; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:graphql-jit | AI (phantom-deps): graphql-jit is a peer/optional runtime dep referenced in config; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@graphql-tools/batch-delegate | AI (phantom-deps): Ecosystem dep referenced in config; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@envelop/extended-validation | AI (phantom-deps): Plugin dep referenced in config; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@graphql-tools/delegate | AI (phantom-deps): Ecosystem dep referenced in config; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@graphql-mesh/string-interpolation | AI (phantom-deps): Same-org sibling package in graphql-mesh monorepo; phantom-dep heuristic is a stable false positive here. | ai |
Versions (showing 100 of 457)
| Version | Deps | Published |
|---|---|---|
| 0.44.2 | 14 / 0 | |
| 0.44.1 | 14 / 0 | |
| 0.44.0 | 14 / 0 | |
| 0.43.4 | 14 / 0 | |
| 0.43.3 | 14 / 0 | |
| 0.43.2 | 14 / 0 | |
| 0.43.1 | 14 / 0 | |
| 0.43.0 | 14 / 0 | |
| 0.42.3 | 12 / 0 | |
| 0.42.2 | 11 / 0 | |
| 0.42.1 | 11 / 0 | |
| 0.42.0 | 11 / 0 | |
| 0.41.10 | 10 / 0 | |
| 0.41.9 | 10 / 0 | |
| 0.41.8 | 10 / 0 | |
| 0.41.7 | 10 / 0 | |
| 0.41.6 | 10 / 0 | |
| 0.41.5 | 10 / 0 | |
| 0.41.4 | 10 / 0 | |
| 0.41.3 | 10 / 0 | |
| 0.41.2 | 10 / 0 | |
| 0.41.1 | 10 / 0 | |
| 0.41.0 | 10 / 0 | |
| 0.40.0 | 10 / 0 | |
| 0.39.1 | 10 / 0 | |
| 0.39.0 | 10 / 0 | |
| 0.38.0 | 10 / 0 | |
| 0.37.1 | 10 / 0 | |
| 0.37.0 | 10 / 0 | |
| 0.36.1 | 9 / 0 | |
| 0.36.0 | 9 / 0 | |
| 0.35.4 | 9 / 0 | |
| 0.35.3 | 9 / 0 | |
| 0.35.2 | 11 / 0 | |
| 0.35.1 | 13 / 0 | |
| 0.35.0 | 13 / 0 | |
| 0.34.10 | 13 / 0 | |
| 0.34.9 | 13 / 0 | |
| 0.34.8 | 14 / 0 | |
| 0.34.7 | 14 / 0 | |
| 0.34.6 | 14 / 0 | |
| 0.34.5 | 14 / 0 | |
| 0.34.4 | 14 / 0 | |
| 0.34.3 | 14 / 0 | |
| 0.34.2 | 14 / 0 | |
| 0.34.1 | 14 / 0 | |
| 0.34.0 | 14 / 0 | |
| 0.33.15 | 14 / 0 | |
| 0.33.14 | 14 / 0 | |
| 0.33.13 | 14 / 0 | |
| 0.33.12 | 14 / 0 | |
| 0.33.11 | 14 / 0 | |
| 0.33.10 | 14 / 0 | |
| 0.33.9 | 14 / 0 | |
| 0.33.8 | 14 / 0 | |
| 0.33.7 | 14 / 0 | |
| 0.33.6 | 14 / 0 | |
| 0.33.5 | 14 / 0 | |
| 0.33.4 | 14 / 0 | |
| 0.33.3 | 14 / 0 | |
| 0.33.2 | 14 / 0 | |
| 0.33.1 | 14 / 0 | |
| 0.33.0 | 14 / 0 | |
| 0.32.0 | 14 / 0 | |
| 0.31.13 | 13 / 0 | |
| 0.31.11 | 13 / 0 | |
| 0.31.10 | 13 / 0 | |
| 0.31.9 | 13 / 0 | |
| 0.31.8 | 13 / 0 | |
| 0.31.7 | 12 / 0 | |
| 0.31.6 | 12 / 0 | |
| 0.31.5 | 12 / 0 | |
| 0.31.4 | 12 / 0 | |
| 0.31.3 | 12 / 0 | |
| 0.31.2 | 12 / 0 | |
| 0.31.1 | 12 / 0 | |
| 0.31.0 | 12 / 0 | |
| 0.30.4 | 10 / 0 | |
| 0.30.3 | 10 / 0 | |
| 0.30.2 | 10 / 0 | |
| 0.30.1 | 10 / 0 | |
| 0.30.0 | 10 / 0 | |
| 0.29.3 | 10 / 0 | |
| 0.29.2 | 10 / 0 | |
| 0.29.1 | 10 / 0 | |
| 0.29.0 | 10 / 0 | |
| 0.28.0 | 10 / 0 | |
| 0.27.1 | 10 / 0 | |
| 0.27.0 | 10 / 0 | |
| 0.26.10 | 10 / 0 | |
| 0.26.9 | 10 / 0 | |
| 0.26.8 | 10 / 0 | |
| 0.26.7 | 10 / 0 | |
| 0.26.6 | 10 / 0 | |
| 0.26.5 | 10 / 0 | |
| 0.26.4 | 10 / 0 | |
| 0.26.3 | 10 / 0 | |
| 0.26.2 | 10 / 0 | |
| 0.26.1 | 10 / 0 | |
| 0.26.0 | 10 / 0 |
v0.44.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.43.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.43.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.43.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.43.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.43.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.42.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.42.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.42.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.42.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.41.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.41.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.41.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.41.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.41.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.41.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.41.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.41.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.41.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.41.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.41.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.40.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.39.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.39.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.38.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.37.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.37.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.36.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.36.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.35.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.35.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.35.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.35.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.35.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.34.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.34.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.34.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.34.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.34.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.34.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.34.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.34.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.34.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.34.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.34.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.15
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.14
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.13
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.12
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.32.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.31.13
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.31.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.31.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.31.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.31.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.31.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.31.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.31.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.31.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.31.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.31.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.31.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.31.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.30.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.30.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.30.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.30.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.30.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.29.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.29.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.29.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.29.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.28.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.27.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.27.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.26.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.26.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.26.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.26.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.26.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.26.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.26.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.26.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.26.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.26.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.26.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.