@openzeppelin/upgrades-core No license 51 versions

@openzeppelin/upgrades-core

npm Repository Homepage

51

Versions

—

License

No

Install Scripts

Verified

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

ernestognwfrangioamxxericglauarr00luiz-lvjson-oz

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
phantom-deps	phantom-dep:fp-ts	AI (phantom-deps): fp-ts/io-ts ecosystem dep likely used indirectly; not a malicious install-script vector.	ai	2026/07/21
provenance	missing-githead	AI (provenance): Established OZ package; missing gitHead reflects publish-env change, no malicious behavior.	ai	2026/07/21
publish-pattern	dormant-publish	AI (publish-pattern): Long gap explained by CI migration; package is actively maintained on GitHub.	ai	2026/06/03
provenance	publisher-changed	AI (provenance): Transition from individual maintainer to GitHub Actions CI/CD; consistent with SLSA provenance attestation.	ai	2026/06/03
npm-metadata	no-description	AI (npm-metadata): Empty description is a metadata oversight on a well-known package.	ai	2026/06/03
dependencies	unvetted-dep:ethereumjs-util	AI (dependencies): ethereumjs-util is a standard Ethereum utility library; its use is expected and appropriate in an Ethereum upgrade tooling package.	ai	2026/04/26
dependencies	unvetted-dep:@nomicfoundation/slang	AI (dependencies): @nomicfoundation/slang is a Solidity parser from Nomic Foundation (Hardhat team), a reputable Ethereum org. Appropriate dependency for Solidity upgrade analysis tooling.	ai	2026/04/26
semgrep	semgrep:hex-decode	AI (semgrep): Hex decoding in this package is standard Ethereum ABI data parsing (stripping 0x prefix from on-chain encoded strings). No obfuscation or malicious payload; stable false positive for this package.	ai	2026/04/26

Versions (showing 51 of 104)

View all versions

Version	Deps	Published
1.46.0	11 / 16	2026-06-02
1.45.0	11 / 16	2026-05-29
1.44.2	11 / 16	2025-11-03
1.44.1	11 / 16	2025-05-21
1.44.0	11 / 16	2025-04-14
1.43.0	10 / 16	2025-04-11
1.42.2	10 / 16	2025-03-19
1.42.1	10 / 16	2025-01-24
1.42.0	10 / 16	2025-01-23
1.41.0	10 / 16	2024-11-25
1.40.0	10 / 16	2024-10-10
1.39.0	10 / 16	2024-10-02
1.38.0	10 / 16	2024-09-23
1.37.1	10 / 16	2024-09-10
1.37.0	10 / 16	2024-08-28
1.36.0	9 / 16	2024-08-21
1.35.1	9 / 16	2024-08-13
1.35.0	9 / 16	2024-07-31
1.34.4	8 / 16	2024-07-22
1.34.3	8 / 16	2024-07-19
1.34.2	8 / 16	2024-07-18
1.34.1	8 / 16	2024-06-18
1.34.0	8 / 16	2024-06-12
1.33.1	8 / 16	2024-04-25
1.33.0	8 / 16	2024-04-24
1.32.6	8 / 16	2024-04-16
1.32.5	8 / 17	2024-02-21
1.32.4	8 / 17	2024-01-30
1.32.3	8 / 17	2024-01-16
1.32.2	8 / 17	2023-12-21
1.32.1	8 / 17	2023-12-14
1.32.0	8 / 17	2023-12-11
1.31.3	8 / 17	2023-11-28
1.31.2	8 / 17	2023-11-28
1.31.1	8 / 17	2023-11-01
1.31.0	8 / 17	2023-10-23
1.30.1	8 / 17	2023-10-11
1.30.0	8 / 17	2023-09-27
1.29.0	8 / 17	2023-09-19
1.28.0	8 / 17	2023-08-03
1.27.3	8 / 17	2023-07-12
1.27.2	8 / 17	2023-07-10
1.27.1	8 / 18	2023-06-15
1.27.0	8 / 18	2023-06-14
1.26.2	7 / 18	2023-05-12
1.26.1	7 / 18	2023-05-12
1.26.0	7 / 18	2023-05-08
1.25.0	7 / 17	2023-04-26
1.24.1	7 / 17	2023-03-02
1.24.0	7 / 17	2023-02-14
1.23.0	7 / 17	2023-02-09

v1.44.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.43.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.42.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.42.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.42.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.41.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.40.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.39.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.38.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.37.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.37.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.36.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.35.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.35.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.34.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.34.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.34.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.34.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.34.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.33.1

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: ericglau.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.33.0

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: ericglau.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.32.6

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: ericglau.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.32.5

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: ericglau.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.32.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.32.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.32.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.32.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.32.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.31.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.31.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.31.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.31.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.30.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.30.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.29.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.28.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.27.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.27.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.27.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.27.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.26.2

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: frangio.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: ericglau → frangio (on 2023-05-12, known maintainer) provenance

This version was published by a different npm account (frangio) than the most recent previously approved version (ericglau) on 2023-05-12, but frangio is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v1.26.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.26.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.25.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.24.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.24.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.23.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.