@redocly/openapi-core
See https://github.com/Redocly/redocly-cli
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-removed | AI (maintainer-change): Single maintainer removal on a large team-maintained package with unchanged provenance; not a takeover pattern. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Redocly is a commercial org; adding team members is routine and consistent with the package's history. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Major version bump (v1→v2) explains large number of new source files; no malicious indicators found. | ai | |
| publish-pattern | rapid-publish | AI (publish-pattern): CI/CD-published package with SLSA provenance; rapid publish is expected for automated release pipelines. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): ajv, ajv-formats, picomatch are established packages added as part of a major version refactor; not suspicious. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require in benchmark fork helper; not reachable from library consumers. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Documented TS dynamic-import workaround in config-resolvers; stable pattern for this package. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): Used only in benchmark tooling (src/benchmark/), not in the main library runtime. | ai | |
| dependencies | unvetted-dep:yaml-ast-parser | AI (dependencies): [email protected] is a long-standing pinned dependency in Redocly's toolchain, not a new or suspicious addition. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Package has 550 versions and is actively maintained by Redocly via CI/CD with SLSA provenance. The dormancy signal does not reflect account takeover risk for this well-established package. | ai | |
| phantom-deps | phantom-dep:ajv | AI (phantom-deps): ajv is declared as an npm alias (npm:@redocly/[email protected]) in package.json — this is an intentional aliasing pattern, not a true phantom dependency. Stable for this package. | ai |
Versions (showing 29 of 29)
| Version | Deps | Published |
|---|---|---|
| 2.41.0 | 11 / 5 | |
| 2.40.0 | 11 / 5 | |
| 2.38.0 | 11 / 6 | |
| 2.36.0 | 10 / 6 | |
| 2.31.0 | 10 / 6 | |
| 2.30.5 | 10 / 6 | |
| 2.30.4 | 10 / 6 | |
| 2.30.3 | 10 / 6 | |
| 2.30.2 | 10 / 6 | |
| 2.30.1 | 10 / 6 | |
| 2.30.0 | 10 / 6 | |
| 2.29.1 | 10 / 6 | |
| 2.29.0 | 10 / 6 | |
| 2.26.0 | 10 / 6 | |
| 2.25.4 | 10 / 6 | |
| 2.14.5 | 10 / 6 | |
| 2.9.0 | 9 / 6 | |
| 2.8.0 | 9 / 6 | |
| 2.5.1 | 9 / 6 | |
| 2.2.3 | 9 / 6 | |
| 2.2.0 | 9 / 6 | |
| 2.1.3 | 9 / 6 | |
| 2.1.0 | 9 / 6 | |
| 2.0.6 | 9 / 6 | |
| 2.0.5 | 9 / 6 | |
| 2.0.1 | 9 / 6 | |
| 1.34.16 | 9 / 6 | |
| 1.34.14 | 9 / 6 | |
| 1.34.13 | 9 / 6 |
v2.41.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.40.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.38.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.36.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.30.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.14.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.2.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.