@lumino/polling — Greenflagged

Lumino Polling

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

blink1073ellisonbgdarianjasongroutjtpiojupyterlab-release-botfcollonval

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
provenance	missing-githead	AI (provenance): Lumino is a well-established JupyterLab project; missing gitHead is a benign publish-environment change, not a security signal.	ai	2026/04/23
provenance	no-provenance	AI (provenance): Lumino predates Sigstore provenance; no attestation is expected for this era of releases.	ai	2026/04/23
provenance	publisher-changed	AI (provenance): darian is the package author and a core JupyterLab/Lumino maintainer; transition from blink1073 is a legitimate team handoff.	ai	2026/04/23
maintainer-change	maintainer-added	AI (maintainer-change): darian is the listed author of @lumino/polling and a long-standing JupyterLab maintainer with strong track record.	ai	2026/04/23
dependencies	unvetted-dep:@lumino/signaling	AI (dependencies): Sibling package in the jupyterlab/lumino monorepo, published by the same trusted release bot. Expected dependency within the Lumino ecosystem.	ai	2026/04/21
dependencies	unvetted-dep:@lumino/disposable	AI (dependencies): Sibling package in the jupyterlab/lumino monorepo, published by the same trusted release bot. Expected dependency within the Lumino ecosystem.	ai	2026/04/21

Versions (showing 35 of 35)

Version	Deps	Published
2.1.5	3 / 19	2025-11-13
2.1.4	3 / 19	2025-03-31
2.1.3	3 / 19	2024-06-28
2.1.2	3 / 24	2023-07-27
2.1.1	3 / 24	2023-04-27
2.1.0	3 / 24	2023-04-07
2.0.0	3 / 24	2023-03-15
1.11.4	3 / 22	2023-01-23
1.11.3	3 / 22	2022-10-31
1.11.2	3 / 22	2022-10-05
1.11.1	3 / 22	2022-08-08
1.11.0	3 / 22	2022-07-21
1.10.0	3 / 22	2022-01-10
1.9.1	3 / 22	2021-11-04
1.9.0	3 / 22	2021-10-25
1.8.0	3 / 22	2021-09-30
1.7.0	3 / 22	2021-09-22
1.6.2	3 / 22	2021-08-23
1.6.1	3 / 22	2021-08-12
1.6.0	3 / 23	2021-04-27
1.5.0	3 / 23	2021-04-19
1.4.0	3 / 23	2021-04-09
1.3.3	3 / 23	2020-07-21
1.3.2	3 / 23	2020-06-26
1.3.1	3 / 24	2020-06-25
1.3.0	3 / 23	2020-05-23
1.2.2	3 / 17	2020-05-12
1.2.1	3 / 17	2020-05-07
1.2.0	3 / 17	2020-04-24
1.1.1	3 / 17	2020-03-22
1.1.0	3 / 17	2020-03-22
1.0.4	3 / 17	2020-02-19
1.0.3	3 / 17	2020-01-02
1.0.2	3 / 17	2019-12-17
1.0.1	3 / 15	2019-12-09

v2.1.5

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.1.4

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.1.3

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.1.2

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v2.1.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.11.4

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: fcollonval.

HIGH Publisher changed: blink1073 → fcollonval (on 2023-01-23) provenance

This version was published by a different npm account than previous versions on 2023-01-23. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.11.3

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: fcollonval.

HIGH Publisher changed: blink1073 → fcollonval (on 2022-10-31) provenance

This version was published by a different npm account than previous versions on 2022-10-31. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.11.2

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: fcollonval.

HIGH Publisher changed: blink1073 → fcollonval (on 2022-10-05) provenance

This version was published by a different npm account than previous versions on 2022-10-05. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.11.1

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: fcollonval.

HIGH Publisher changed: blink1073 → fcollonval (on 2022-08-08) provenance

This version was published by a different npm account than previous versions on 2022-08-08. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.11.0

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: darian.

HIGH Publisher changed: blink1073 → darian (on 2022-07-21) provenance

This version was published by a different npm account than previous versions on 2022-07-21. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.10.0

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: blink1073.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.9.1

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: jasongrout.

HIGH Publisher changed: blink1073 → jasongrout (on 2021-11-04) provenance

This version was published by a different npm account than previous versions on 2021-11-04. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.9.0

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: blink1073.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.8.0

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: blink1073.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.7.0

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: blink1073.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.6.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.6.1

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: blink1073.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.6.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.5.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.4.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.1

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: darian.

HIGH Publisher changed: blink1073 → darian (on 2020-03-22) provenance

This version was published by a different npm account than previous versions on 2020-03-22. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.