@openrewrite/rewrite
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | missing-githead | AI (provenance): Large active project with frequent releases; occasional gitHead gaps are a CI config issue, not a supply-chain indicator. | ai | |
| phantom-deps | phantom-dep:dedent | AI (phantom-deps): dedent is declared in dependencies and likely used in dist output; phantom-dep heuristic false positive. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): commander/typescript/tmp-promise are established packages added for the RPC server feature; not suspicious for this package. | ai | |
| provenance | publisher-changed | AI (provenance): Transition from individual (zieka) to GitHub Actions CI publisher is expected for a maturing project; SLSA attestation confirms integrity. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Spreading process.env into child_process spawn options is standard; not exfiltration. | ai | |
| phantom-deps | phantom-dep:@types/node | AI (phantom-deps): @types/node is a type-only dep used at compile time; not imported at runtime. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Resolves optional prettier peer dep by path; documented plugin-loader pattern. | ai |
Versions (showing 57 of 157)
| Version | Deps | Published |
|---|---|---|
| 8.73.1 | 12 / 12 | |
| 8.73.0 | 12 / 12 | |
| 8.72.8 | 12 / 13 | |
| 8.72.7 | 12 / 12 | |
| 8.72.6 | 12 / 12 | |
| 8.72.5 | 12 / 12 | |
| 8.72.4 | 12 / 12 | |
| 8.72.3 | 12 / 12 | |
| 8.72.2 | 12 / 12 | |
| 8.72.1 | 12 / 12 | |
| 8.72.0 | 12 / 12 | |
| 8.71.0 | 12 / 12 | |
| 8.70.4 | 12 / 12 | |
| 8.70.3 | 12 / 12 | |
| 8.70.2 | 12 / 12 | |
| 8.70.1 | 12 / 12 | |
| 8.70.0 | 12 / 12 | |
| 8.69.1 | 12 / 11 | |
| 8.69.0 | 12 / 10 | |
| 8.68.1 | 11 / 10 | |
| 8.68.0 | 11 / 10 | |
| 8.67.1 | 9 / 9 | |
| 8.67.0 | 9 / 9 | |
| 8.66.4 | 9 / 9 | |
| 8.66.3 | 9 / 9 | |
| 8.66.2 | 9 / 9 | |
| 8.66.1 | 9 / 7 | |
| 8.66.0 | 9 / 7 | |
| 8.65.0 | 10 / 7 | |
| 8.64.0 | 10 / 7 | |
| 8.63.4 | 10 / 7 | |
| 8.63.3 | 10 / 7 | |
| 8.63.2 | 10 / 7 | |
| 8.63.1 | 10 / 7 | |
| 8.63.0 | 10 / 7 | |
| 8.62.6 | 10 / 7 | |
| 8.62.5 | 10 / 7 | |
| 8.62.4 | 9 / 6 | |
| 8.62.3 | 9 / 6 | |
| 8.62.2 | 9 / 6 | |
| 8.62.1 | 9 / 6 | |
| 8.61.1 | 9 / 7 | |
| 8.61.0 | 9 / 7 | |
| 8.60.2 | 9 / 6 | |
| 8.60.1 | 9 / 6 | |
| 8.60.0 | 9 / 6 | |
| 8.59.1 | 9 / 6 | |
| 8.59.0 | 9 / 6 | |
| 8.58.0 | 9 / 6 | |
| 8.57.0 | 9 / 6 | |
| 8.55.3 | 6 / 6 | |
| 8.55.2 | 6 / 6 | |
| 8.55.1 | 6 / 6 | |
| 8.55.0 | 6 / 6 | |
| 8.54.0 | 6 / 5 | |
| 8.53.1 | 6 / 5 | |
| 8.53.0 | 6 / 5 |
v8.73.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.73.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.72.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.72.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.72.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.72.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.72.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.72.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.72.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.72.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.72.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.71.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.70.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.70.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.70.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.70.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.70.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.69.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.69.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.68.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.68.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.