@strands-agents/sdk
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | missing-githead | AI (provenance): CI publish env drift; version retains SLSA/Sigstore attestation. Stable FP for this package. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): yaml is a well-known, widely-used YAML parsing library; not a suspicious dependency. | ai | |
| source-diff | large-new-source-files | AI (source-diff): 1.0.0 major release with expanded model support; large file count expected for a significant version bump. | ai | |
| phantom-deps | phantom-dep:@types/json-schema | AI (phantom-deps): Type-only package used for TypeScript type declarations; not directly imported at runtime. | ai |
Versions (showing 29 of 29)
| Version | Deps | Published |
|---|---|---|
| 1.11.1 | 4 / 41 | |
| 1.11.0 | 4 / 41 | |
| 1.10.0 | 4 / 41 | |
| 1.9.0 | 4 / 42 | |
| 1.8.0 | 4 / 42 | |
| 1.7.0 | 4 / 42 | |
| 1.6.0 | 4 / 42 | |
| 1.5.0 | 4 / 40 | |
| 1.4.0 | 4 / 37 | |
| 1.3.0 | 4 / 37 | |
| 1.2.0 | 4 / 35 | |
| 1.1.0 | 4 / 35 | |
| 1.0.0 | 4 / 35 | |
| 0.7.0 | 3 / 33 | |
| 0.6.0 | 2 / 29 | |
| 0.5.0 | 1 / 26 | |
| 0.4.0 | 1 / 21 | |
| 0.3.0 | 1 / 20 | |
| 0.2.2 | 1 / 20 | |
| 0.2.1 | 1 / 19 | |
| 0.2.0 | 1 / 18 | |
| 0.1.6 | 3 / 17 | |
| 0.1.5 | 3 / 17 | |
| 0.1.4 | 3 / 17 | |
| 0.1.3 | 3 / 17 | |
| 0.1.2 | 3 / 17 | |
| 0.1.1 | 3 / 17 | |
| 0.1.0 | 3 / 17 | |
| 0.0.1 | 3 / 17 |
v1.11.1
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
v1.11.0
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
v1.10.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.9.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.8.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.