@langchain/langgraph-checkpoint-sqlite
LangGraph
13
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
hwchase17jacoblee93basprouleric_langchainandrewnguonlydavidduongmaddyadamssam_noyeslangchain-securityarjun-natarajan-langchainandy-langchainrcasuphntrlchristian-bromann
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| npm-metadata | suspicious-initial-version | AI (npm-metadata): 0.0.0 is the intentional initial version scheme used across the LangGraph JS monorepo; not indicative of malicious throwaway package given established publisher and official repo. | ai | |
| provenance | no-provenance | AI (provenance): Publisher jacoblee93 has a long track record; lack of provenance is common and not a risk signal for this package. | ai | |
| provenance | missing-githead | AI (provenance): Package has SLSA provenance attestation which supersedes gitHead as a source link. The transition to GitHub Actions CI/CD publishing explains the missing gitHead field. | ai | |
| provenance | publisher-changed | AI (provenance): LangChain migrated to GitHub Actions for automated publishing, corroborated by SLSA provenance attestation. This is a legitimate CI/CD transition for the official langchain-ai org. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): andy-langchain and rcasup are LangChain organization accounts; addition is consistent with normal team evolution at an established org. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): nfcampos removal is consistent with team role changes at LangChain; no evidence of hostile takeover given SLSA attestation and official repo match. | ai |