@n8n/db
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Transition from manual publish (tomin8n) to GitHub Actions CI/CD with SLSA attestation is a provenance improvement, not a risk. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): @n8n/utils is a first-party n8n monorepo package; not a suspicious third-party dep. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Same as above — removal paired with addition consistent with username change, not takeover. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Appears to be an n8n org username rename; SLSA provenance and official repo confirm legitimate CI/CD publish. | ai | |
| publish-pattern | rapid-publish | AI (publish-pattern): n8n monorepo uses automated CI/CD with SLSA provenance; rapid publishes are expected across coordinated package releases. | ai | |
| license | uncommon-license:SEE LICENSE IN LICENSE.md | AI (license): Dual-license pattern (OSS + EE); stable for n8n packages. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Active n8n monorepo package; new source files are expected across frequent releases. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Internal monorepo package; missing description is a known pattern, not a malware signal here. | ai | |
| dependencies | unvetted-dep:@n8n/typeorm | AI (dependencies): Internal n8n fork of TypeORM; stable dependency for this package. | ai | |
| dependencies | unvetted-dep:p-lazy | AI (dependencies): p-lazy is a well-known sindresorhus utility; stable dependency for this package. | ai | |
| typosquat | typosquat.levenshtein:pg | AI (typosquat): Scoped @n8n/db is an internal n8n package, not a typosquat of pg. | ai | |
| phantom-deps | phantom-dep:reflect-metadata | AI (phantom-deps): reflect-metadata is a known implicit runtime dep for TypeORM/decorator-based packages. | ai | |
| typosquat | typosquat.levenshtein:qs | AI (typosquat): Scoped @n8n/db is an internal n8n package, not a typosquat of qs. | ai |
Versions (showing 51 of 188)
| Version | Deps | Published |
|---|---|---|
| 1.32.2 | 20 / 13 | |
| 1.32.1 | 20 / 13 | |
| 1.32.0 | 20 / 13 | |
| 1.31.4 | 20 / 12 | |
| 1.31.3 | 20 / 12 | |
| 1.31.2 | 20 / 12 | |
| 1.31.1 | 20 / 12 | |
| 1.31.0 | 20 / 12 | |
| 1.30.4 | 20 / 12 | |
| 1.30.3 | 20 / 12 | |
| 1.30.2 | 20 / 12 | |
| 1.30.1 | 20 / 12 | |
| 1.30.0 | 20 / 12 | |
| 1.29.8 | 20 / 11 | |
| 1.29.7 | 20 / 11 | |
| 1.29.6 | 20 / 11 | |
| 1.29.5 | 20 / 11 | |
| 1.29.4 | 20 / 11 | |
| 1.29.3 | 20 / 11 | |
| 1.29.2 | 20 / 11 | |
| 1.29.1 | 20 / 11 | |
| 1.29.0 | 20 / 11 | |
| 1.28.5 | 20 / 10 | |
| 1.28.4 | 20 / 10 | |
| 1.28.3 | 20 / 10 | |
| 1.28.2 | 20 / 10 | |
| 1.28.1 | 20 / 10 | |
| 1.28.0 | 20 / 10 | |
| 1.27.4 | 20 / 9 | |
| 1.27.3 | 20 / 9 | |
| 1.27.2 | 20 / 9 | |
| 1.27.1 | 20 / 9 | |
| 1.27.0 | 20 / 9 | |
| 1.26.4 | 20 / 8 | |
| 1.26.3 | 20 / 8 | |
| 1.26.2 | 20 / 8 | |
| 1.26.1 | 20 / 8 | |
| 1.26.0 | 20 / 8 | |
| 1.25.2 | 20 / 3 | |
| 1.25.1 | 20 / 3 | |
| 1.25.0 | 20 / 3 | |
| 1.24.0 | 20 / 3 | |
| 1.23.1 | 20 / 3 | |
| 1.23.0 | 20 / 3 | |
| 1.22.4 | 20 / 3 | |
| 1.22.3 | 20 / 3 | |
| 1.22.2 | 20 / 3 | |
| 1.22.1 | 20 / 3 | |
| 1.22.0 | 20 / 3 | |
| 1.21.5 | 20 / 3 | |
| 1.21.4 | 20 / 3 |
v1.32.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.32.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.32.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.31.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.31.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.31.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.31.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.31.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.30.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.30.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.30.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.30.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.30.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.29.8
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.29.7
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.29.6
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.29.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.29.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.29.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.29.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.29.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.29.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.28.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.28.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.28.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.28.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.28.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.28.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.27.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.27.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.27.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.27.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.26.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.26.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.26.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.26.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.25.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.25.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.25.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.24.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.23.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.23.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.22.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.22.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.22.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.21.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.21.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.