@graphql-mesh/runtime
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:@graphql-mesh/utils | AI (phantom-deps): Same-org sibling package, expected dependency. | ai | |
| phantom-deps | phantom-dep:ts-node | AI (phantom-deps): Build-time dep, false positive pattern for this package. | ai | |
| phantom-deps | phantom-dep:@graphql-mesh/extend | AI (phantom-deps): Same-org monorepo sibling, expected dependency. | ai | |
| phantom-deps | phantom-dep:apollo-server | AI (phantom-deps): Peer/optional integration dep for this GraphQL package. | ai | |
| phantom-deps | phantom-dep:winston | AI (phantom-deps): Common logging dep, false-positive prone on compiled output. | ai | |
| phantom-deps | phantom-dep:js-yaml | AI (phantom-deps): Common config-parsing dep, false-positive prone on compiled output. | ai | |
| phantom-deps | phantom-dep:mkdirp | AI (phantom-deps): Common utility dep, false-positive prone on compiled output. | ai | |
| phantom-deps | phantom-dep:yargs | AI (phantom-deps): Common CLI dep, false-positive prone on compiled output. | ai | |
| phantom-deps | phantom-dep:chalk | AI (phantom-deps): Common utility dep, false-positive prone on compiled output. | ai | |
| phantom-deps | phantom-dep:@graphql-mesh/rename | AI (phantom-deps): Same-org monorepo sibling, expected dependency. | ai | |
| phantom-deps | phantom-dep:@graphql-mesh/prefix | AI (phantom-deps): Same-org monorepo sibling, expected dependency. | ai | |
| phantom-deps | phantom-dep:tsee | AI (phantom-deps): Declared dep likely used via bundled/minified output, not malicious. | ai | |
| phantom-deps | phantom-dep:@graphql-toolkit/schema-merging | AI (phantom-deps): Likely used in bundled/minified output; not a real risk signal here. | ai | |
| phantom-deps | phantom-dep:@graphql-tools/merge | AI (phantom-deps): Core graphql-tools dep likely used via dynamic import/bundling. | ai | |
| phantom-deps | phantom-dep:@envelop/live-query | AI (phantom-deps): Likely used via bundled dist output; benign for this monorepo package. | ai | |
| phantom-deps | phantom-dep:@graphql-tools/wrap | AI (phantom-deps): Likely used via type re-exports in a monorepo package; benign for this ecosystem. | ai | |
| phantom-deps | phantom-dep:@graphql-tools/schema | AI (phantom-deps): Likely used via bundled/dual build output; established monorepo package. | ai | |
| phantom-deps | phantom-dep:@graphql-tools/resolvers-composition | AI (phantom-deps): Likely used via bundled/dual build output; established monorepo package. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): Known implicit runtime dependency. | ai | |
| phantom-deps | phantom-dep:@n1ru4l/graphql-live-query | AI (phantom-deps): Likely used via bundled/dual build output; established monorepo package. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Module-loader pattern trying alternate parser packages; consistent with graphql-mesh's plugin architecture. | ai | |
| phantom-deps | phantom-dep:aggregate-error | AI (phantom-deps): Bundled cjs output obscures imports; likely used internally. | ai | |
| phantom-deps | phantom-dep:@graphql-tools/stitch | AI (phantom-deps): Bundled cjs output obscures imports; likely used internally. | ai | |
| phantom-deps | phantom-dep:@graphql-mesh/merger-stitching | AI (phantom-deps): Same-org dep, bundler hides direct import. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): New deps are first-party graphql-tools/graphql-jit ecosystem packages. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Feature-detection snippet (`new Function('return true')`), not code execution of external input. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): enisdenjo and theguild-bot are known graphql-mesh org maintainers; legitimate org-level change. | ai | |
| provenance | publisher-changed | AI (provenance): Org migrated to GitHub Actions CI publishing with SLSA attestation; stable pattern for this package going forward. | ai | |
| phantom-deps | phantom-dep:@envelop/graphql-jit | AI (phantom-deps): Plugin dep referenced in config files, not directly imported; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:graphql-jit | AI (phantom-deps): graphql-jit is a peer/optional runtime dep referenced in config; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@graphql-tools/batch-delegate | AI (phantom-deps): Ecosystem dep referenced in config; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@envelop/extended-validation | AI (phantom-deps): Plugin dep referenced in config; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@graphql-tools/delegate | AI (phantom-deps): Ecosystem dep referenced in config; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@graphql-mesh/string-interpolation | AI (phantom-deps): Same-org sibling package in graphql-mesh monorepo; phantom-dep heuristic is a stable false positive here. | ai |
Versions (showing 100 of 454)
| Version | Deps | Published |
|---|---|---|
| 0.99.3 | 10 / 0 | |
| 0.99.2 | 10 / 0 | |
| 0.99.1 | 10 / 0 | |
| 0.99.0 | 10 / 0 | |
| 0.98.8 | 10 / 0 | |
| 0.98.7 | 10 / 0 | |
| 0.98.6 | 10 / 0 | |
| 0.98.5 | 10 / 0 | |
| 0.98.4 | 10 / 0 | |
| 0.98.3 | 10 / 0 | |
| 0.98.2 | 10 / 0 | |
| 0.98.1 | 10 / 0 | |
| 0.98.0 | 10 / 0 | |
| 0.97.7 | 10 / 0 | |
| 0.97.6 | 10 / 0 | |
| 0.97.5 | 10 / 0 | |
| 0.97.4 | 10 / 0 | |
| 0.97.3 | 10 / 0 | |
| 0.97.2 | 10 / 0 | |
| 0.97.1 | 10 / 0 | |
| 0.97.0 | 10 / 0 | |
| 0.96.13 | 10 / 0 | |
| 0.96.12 | 10 / 0 | |
| 0.96.11 | 10 / 0 | |
| 0.96.10 | 10 / 0 | |
| 0.96.9 | 10 / 0 | |
| 0.96.4 | 7 / 0 | |
| 0.96.3 | 7 / 0 | |
| 0.96.2 | 7 / 0 | |
| 0.96.1 | 7 / 0 | |
| 0.96.0 | 8 / 0 | |
| 0.95.4 | 8 / 0 | |
| 0.95.3 | 8 / 0 | |
| 0.95.2 | 8 / 0 | |
| 0.95.1 | 8 / 0 | |
| 0.95.0 | 8 / 0 | |
| 0.94.2 | 8 / 0 | |
| 0.94.1 | 8 / 0 | |
| 0.94.0 | 8 / 0 | |
| 0.93.2 | 8 / 0 | |
| 0.93.1 | 8 / 0 | |
| 0.46.24 | 8 / 0 | |
| 0.46.23 | 8 / 0 | |
| 0.46.22 | 8 / 0 | |
| 0.46.21 | 8 / 0 | |
| 0.46.20 | 13 / 0 | |
| 0.46.19 | 13 / 0 | |
| 0.46.18 | 13 / 0 | |
| 0.46.16 | 13 / 0 | |
| 0.46.15 | 13 / 0 | |
| 0.46.14 | 13 / 0 | |
| 0.46.13 | 13 / 0 | |
| 0.46.12 | 13 / 0 | |
| 0.46.10 | 13 / 0 | |
| 0.46.9 | 13 / 0 | |
| 0.46.8 | 13 / 0 | |
| 0.46.7 | 13 / 0 | |
| 0.46.6 | 13 / 0 | |
| 0.46.5 | 13 / 0 | |
| 0.46.4 | 13 / 0 | |
| 0.46.3 | 13 / 0 | |
| 0.46.2 | 13 / 0 | |
| 0.46.1 | 13 / 0 | |
| 0.46.0 | 13 / 0 | |
| 0.45.0 | 13 / 0 | |
| 0.44.37 | 13 / 0 | |
| 0.44.36 | 13 / 0 | |
| 0.44.35 | 13 / 0 | |
| 0.44.34 | 13 / 0 | |
| 0.44.33 | 13 / 0 | |
| 0.44.32 | 13 / 0 | |
| 0.44.31 | 13 / 0 | |
| 0.44.30 | 13 / 0 | |
| 0.44.29 | 13 / 0 | |
| 0.44.28 | 13 / 0 | |
| 0.44.27 | 13 / 0 | |
| 0.44.26 | 13 / 0 | |
| 0.44.25 | 13 / 0 | |
| 0.44.24 | 13 / 0 | |
| 0.44.23 | 13 / 0 | |
| 0.44.22 | 13 / 0 | |
| 0.44.21 | 14 / 0 | |
| 0.44.20 | 14 / 0 | |
| 0.44.19 | 14 / 0 | |
| 0.44.18 | 14 / 0 | |
| 0.44.17 | 14 / 0 | |
| 0.44.16 | 14 / 0 | |
| 0.44.15 | 14 / 0 | |
| 0.44.14 | 14 / 0 | |
| 0.44.13 | 14 / 0 | |
| 0.44.12 | 14 / 0 | |
| 0.44.11 | 14 / 0 | |
| 0.44.10 | 14 / 0 | |
| 0.44.9 | 14 / 0 | |
| 0.44.8 | 14 / 0 | |
| 0.44.7 | 14 / 0 | |
| 0.44.6 | 14 / 0 | |
| 0.44.5 | 14 / 0 | |
| 0.44.4 | 14 / 0 | |
| 0.44.3 | 14 / 0 |
v0.99.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.99.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.99.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.99.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.98.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.98.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.98.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.98.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.98.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.98.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.98.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.98.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.98.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.97.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.97.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.97.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.97.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.97.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.97.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.97.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.97.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.96.13
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.96.12
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.96.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.96.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.96.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.96.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.96.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.96.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.96.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.95.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.95.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.95.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.95.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.95.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.94.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.94.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.94.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.93.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.93.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.46.24
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.46.23
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.46.22
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.46.21
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.46.20
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.46.19
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.46.18
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.46.16
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.46.15
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.46.14
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.46.13
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.46.12
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.46.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.46.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.46.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.46.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.46.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.46.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.46.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.46.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.46.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.46.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.46.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.45.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.37
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.36
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.35
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.34
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.33
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.32
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.31
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.30
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.29
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.28
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.27
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.26
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.25
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.24
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.23
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.22
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.21
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.20
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.19
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.18
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.17
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.16
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.15
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.14
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.13
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.12
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.