@omnigraph/openapi
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Transition to GitHub Actions CI publisher with SLSA attestation is the expected pattern for this monorepo; not a takeover signal. | ai | |
| provenance | slsa-provenance | AI (provenance): SLSA provenance attestation confirms legitimate CI/CD publishing pipeline. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Established package with strong provenance; missing description is stable metadata quirk, not malware indicator. | ai | |
| dependencies | unvetted-dep:@omnigraph/json-schema | AI (dependencies): Sibling omnigraph package from the same monorepo; not a risk. | ai | |
| dependencies | unvetted-dep:@graphql-mesh/cross-helpers | AI (dependencies): Core graphql-mesh package from the same monorepo; not a risk. | ai | |
| dependencies | unvetted-dep:json-machete | AI (dependencies): Part of the graphql-mesh monorepo ecosystem; stable dependency pattern across versions. | ai | |
| dependencies | unvetted-dep:@graphql-mesh/string-interpolation | AI (dependencies): Core graphql-mesh package from the same monorepo; not a risk. | ai | |
| dependencies | unvetted-dep:@graphql-mesh/fusion-composition | AI (dependencies): Core graphql-mesh package from the same monorepo; not a risk. | ai | |
| dependencies | unvetted-dep:@graphql-mesh/types | AI (dependencies): Core graphql-mesh package from the same monorepo; not a risk. | ai | |
| dependencies | unvetted-dep:@graphql-mesh/utils | AI (dependencies): Core graphql-mesh package from the same monorepo; not a risk. | ai |
Versions (showing 100 of 274)
| Version | Deps | Published |
|---|---|---|
| 0.105.1 | 6 / 0 | |
| 0.105.0 | 6 / 0 | |
| 0.104.0 | 6 / 0 | |
| 0.103.2 | 6 / 0 | |
| 0.103.1 | 6 / 0 | |
| 0.103.0 | 6 / 0 | |
| 0.102.7 | 6 / 0 | |
| 0.102.6 | 6 / 0 | |
| 0.102.5 | 6 / 0 | |
| 0.102.4 | 6 / 0 | |
| 0.102.3 | 6 / 0 | |
| 0.102.2 | 6 / 0 | |
| 0.102.1 | 6 / 0 | |
| 0.102.0 | 6 / 0 | |
| 0.101.2 | 6 / 0 | |
| 0.101.1 | 6 / 0 | |
| 0.101.0 | 6 / 0 | |
| 0.100.14 | 6 / 0 | |
| 0.100.13 | 6 / 0 | |
| 0.100.12 | 6 / 0 | |
| 0.100.11 | 6 / 0 | |
| 0.100.10 | 6 / 0 | |
| 0.100.9 | 6 / 0 | |
| 0.100.8 | 6 / 0 | |
| 0.100.7 | 6 / 0 | |
| 0.100.6 | 6 / 0 | |
| 0.100.5 | 6 / 0 | |
| 0.100.4 | 6 / 0 | |
| 0.100.3 | 6 / 0 | |
| 0.100.2 | 6 / 0 | |
| 0.100.1 | 6 / 0 | |
| 0.97.5 | 5 / 0 | |
| 0.97.4 | 5 / 0 | |
| 0.97.3 | 5 / 0 | |
| 0.97.2 | 5 / 0 | |
| 0.97.1 | 5 / 0 | |
| 0.97.0 | 5 / 0 | |
| 0.96.0 | 5 / 0 | |
| 0.95.12 | 5 / 0 | |
| 0.95.11 | 5 / 0 | |
| 0.95.10 | 5 / 0 | |
| 0.95.9 | 5 / 0 | |
| 0.95.8 | 5 / 0 | |
| 0.95.7 | 5 / 0 | |
| 0.95.6 | 5 / 0 | |
| 0.95.5 | 5 / 0 | |
| 0.95.4 | 5 / 0 | |
| 0.95.3 | 5 / 0 | |
| 0.95.2 | 5 / 0 | |
| 0.95.1 | 5 / 0 | |
| 0.95.0 | 5 / 0 | |
| 0.94.10 | 5 / 0 | |
| 0.94.9 | 5 / 0 | |
| 0.94.8 | 5 / 0 | |
| 0.94.7 | 5 / 0 | |
| 0.94.6 | 5 / 0 | |
| 0.94.5 | 5 / 0 | |
| 0.94.4 | 5 / 0 | |
| 0.94.3 | 5 / 0 | |
| 0.94.2 | 5 / 0 | |
| 0.94.1 | 5 / 0 | |
| 0.94.0 | 5 / 0 | |
| 0.93.2 | 5 / 0 | |
| 0.93.1 | 5 / 0 | |
| 0.19.27 | 5 / 0 | |
| 0.19.26 | 5 / 0 | |
| 0.19.25 | 9 / 0 | |
| 0.19.24 | 9 / 0 | |
| 0.19.23 | 9 / 0 | |
| 0.19.21 | 9 / 0 | |
| 0.19.20 | 9 / 0 | |
| 0.19.19 | 9 / 0 | |
| 0.19.18 | 9 / 0 | |
| 0.19.17 | 9 / 0 | |
| 0.19.16 | 9 / 0 | |
| 0.19.15 | 9 / 0 | |
| 0.19.14 | 9 / 0 | |
| 0.19.13 | 9 / 0 | |
| 0.19.12 | 9 / 0 | |
| 0.19.11 | 9 / 0 | |
| 0.19.10 | 9 / 0 | |
| 0.19.9 | 9 / 0 | |
| 0.19.8 | 9 / 0 | |
| 0.19.7 | 9 / 0 | |
| 0.19.6 | 9 / 0 | |
| 0.19.5 | 9 / 0 | |
| 0.19.4 | 9 / 0 | |
| 0.19.3 | 9 / 0 | |
| 0.19.2 | 9 / 0 | |
| 0.19.1 | 9 / 0 | |
| 0.19.0 | 9 / 0 | |
| 0.18.0 | 9 / 0 | |
| 0.17.11 | 9 / 0 | |
| 0.17.10 | 9 / 0 | |
| 0.17.9 | 9 / 0 | |
| 0.17.8 | 9 / 0 | |
| 0.17.7 | 9 / 0 | |
| 0.17.6 | 9 / 0 | |
| 0.17.5 | 9 / 0 | |
| 0.17.4 | 9 / 0 |
v0.105.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.105.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.104.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.103.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.103.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.103.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.102.7
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.102.6
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.102.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.102.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.102.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.102.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.102.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.102.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.101.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.101.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.101.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.100.14
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.100.13
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.100.12
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.100.11
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.100.10
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.100.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.100.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.100.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.100.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.100.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.100.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.100.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.100.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.100.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.97.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.97.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.97.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.97.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.97.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.97.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.96.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.95.12
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.95.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.95.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.95.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.95.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.95.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.95.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.95.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.95.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.95.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.95.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.95.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.95.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.94.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.94.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.94.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.94.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.94.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.94.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.94.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.94.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.94.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.94.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.94.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.93.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.93.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.19.27
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.19.26
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.19.25
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.19.24
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.19.23
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.19.21
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.19.20
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.19.19
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.19.18
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.19.17
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.19.16
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.19.15
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.19.14
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.19.13
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.19.12
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.19.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.19.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.19.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.19.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.19.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.19.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.19.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.19.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.19.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.19.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.19.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.19.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.18.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.