@pulumi/awsx
[](https://github.com/pulumi/pulumi-awsx/actions) [](https://slack.pulumi.com) [ relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@pulumi/aws | AI (dependencies): First-party Pulumi AWS provider; core dependency of @pulumi/awsx across all versions. Not a risk. | ai | |
| dependencies | unvetted-dep:@pulumi/docker | AI (dependencies): First-party Pulumi Docker provider; stable dependency of @pulumi/awsx for container-related resources. | ai | |
| dependencies | unvetted-dep:docker-classic | AI (dependencies): Alias for @pulumi/[email protected] used for backward compatibility; first-party Pulumi package, not a risk. | ai | |
| dependencies | unvetted-dep:@pulumi/docker-build | AI (dependencies): First-party Pulumi Docker Build provider; legitimate dependency for image-building resources in awsx. | ai | |
| phantom-deps | phantom-dep:@types/aws-lambda | AI (phantom-deps): Type-only package used by convention in Pulumi component packages; not a risk. | ai | |
| phantom-deps | phantom-dep:@pulumi/docker-build | AI (phantom-deps): Same-org Pulumi package; may be loaded indirectly via resource registration rather than direct import. | ai | |
| provenance | no-provenance | AI (provenance): Pulumi publishes via pulumi-bot automation; lack of Sigstore provenance is consistent across their packages and not a risk signal given publisher track record. | ai |
Versions (showing 10 of 10)
| Version | Deps | Published |
|---|---|---|
| 3.6.0 | 8 / 3 | |
| 3.5.0 | 8 / 3 | |
| 3.4.0 | 8 / 3 | |
| 3.3.1 | 8 / 3 | |
| 3.3.0 | 8 / 3 | |
| 3.2.1 | 8 / 3 | |
| 3.2.0 | 8 / 3 | |
| 3.1.0 | 8 / 3 | |
| 3.0.1 | 8 / 3 | |
| 3.0.0 | 8 / 3 |
v3.6.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.5.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.4.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.3.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.3.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.2.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.2.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.