All @mastra/observability versions
@mastra/observability @1.14.2
Maintainers
Dependencies (1)
| Package | Constraint | Registry Status |
|---|---|---|
| easy-day-js | ^1.11.21 | auto_approved |
Dev Dependencies (13)
| Package | Constraint | Registry Status |
|---|---|---|
| zod | ^4.4.3 | auto_approved |
| tsup | ^8.5.1 | auto_approved |
| eslint | ^10.2.1 | auto_approved |
| vitest | 4.1.5 | No greenflagged match |
| @vitest/ui | 4.1.5 | auto_approved |
| typescript | ^6.0.3 | auto_approved |
| @types/node | 22.19.15 | auto_approved |
| @mastra/core | 1.38.0 | auto_approved |
| @internal/lint | 0.0.100 | Not imported |
| @internal/ai-sdk-v4 | 0.0.47 | Not imported |
| @internal/ai-sdk-v5 | 0.0.47 | Not imported |
| @vitest/coverage-v8 | 4.1.5 | auto_approved |
| @internal/types-builder | 0.0.75 | Not imported |
Transitive Dependency Tree
Changes from v1.14.1
Dependency Changes
| Change | Package | Version |
|---|---|---|
| added | easy-day-js | ^1.11.21 |
File Changes
SAST Findings (2)
This version was published without provenance, but prior versions were published via CI/CD with attestations. This is a strong signal of a potential account compromise or unauthorized publish. The axios attack (March 2026) exhibited exactly this pattern.
This version was published by a different npm account (ehindero) than the most recent previously approved version (GitHub Actions) on 2026-06-17, but ehindero is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
Review Summary
Risk score: 48. Findings: 1 high (+25), 2 medium (+20), 1 low (+3), 2 info (+0).
Published to npm: